65f169c6d38873e5a01143b08b90afd4bcb6088beedc374ab93edc1e49caf152

Analysis

user interaction
yes
max time kernel
10s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cracked by @ntpx.exe
Size 535.5MB
Sample260728-batvcsgr8v
SHA256 65f169c6d38873e5a01143b08b90afd4bcb6088beedc374ab93edc1e49caf152
MD5 977bbe9b31d8ad6fdeeddf87d5006c45
SHA1 2abe23a07751dc0ff8b750b5d2e38b5756fc05c0
SHA512 d8bea520cb1b56b72024f8b35babfe2162341c7da7f8a22ebe0f02e235a15e39a4af6077eabf15f97d6088a6b5a956083d6f3f6e5bb81a95807b4e5dc502f8ef
SSDEEP 3145728:RVLH7yDhpmFzVeQXBOn60rqVLH7yDhpmFzV:LLH74gs8LH74
TLSH
T152499C03F29A41E9E05DD175974A9633EA71B80A4B25B3CF2A5807522F77EF81B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cracked by @ntpx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cracked by @ntpx.exe

Loads dropped DLL 8 IoCs

pid	Process
2940	cracked by @ntpx.exe
2940	cracked by @ntpx.exe
2940	cracked by @ntpx.exe
2940	cracked by @ntpx.exe
2940	cracked by @ntpx.exe
2940	cracked by @ntpx.exe
2940	cracked by @ntpx.exe
2212	cracked by @ntpx.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5356	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 43 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3024	powershell.exe
5336	powershell.exe
5256	powershell.exe
924	powershell.exe
692	powershell.exe
5176	powershell.exe
400	powershell.exe
5292	powershell.exe
5136	powershell.exe
6012	powershell.exe
6140	powershell.exe
5860	powershell.exe
5612	powershell.exe
1072	powershell.exe
3956	powershell.exe
368	powershell.exe
4184	powershell.exe
1676	powershell.exe
2420	powershell.exe
5340	powershell.exe
5820	powershell.exe
1936	powershell.exe
3784	powershell.exe
1092	powershell.exe
4840	powershell.exe
4968	powershell.exe
4052	powershell.exe
3384	powershell.exe
4680	powershell.exe
5944	powershell.exe
4656	powershell.exe
5112	powershell.exe
5872	powershell.exe
6088	powershell.exe
5888	powershell.exe
4116	powershell.exe
1696	powershell.exe
412	powershell.exe
1624	powershell.exe
2324	powershell.exe
6120	powershell.exe
5500	powershell.exe
4716	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2860	cracked by @ntpx.exe
Token: SeCreatePagefilePrivilege	2860	cracked by @ntpx.exe
Token: SeShutdownPrivilege	2860	cracked by @ntpx.exe
Token: SeCreatePagefilePrivilege	2860	cracked by @ntpx.exe
Token: SeShutdownPrivilege	2860	cracked by @ntpx.exe
Token: SeCreatePagefilePrivilege	2860	cracked by @ntpx.exe
Token: SeShutdownPrivilege	2860	cracked by @ntpx.exe
Token: SeCreatePagefilePrivilege	2860	cracked by @ntpx.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2940	2860	cracked by @ntpx.exe	88
PID 2860 wrote to memory of 2832	2860	cracked by @ntpx.exe	89
PID 2860 wrote to memory of 2212	2860	cracked by @ntpx.exe	90

C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
"C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --gpu-preferences=SAAAAAAAAADgABQEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,518698377564684571,15258621599471653097,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Loads dropped DLL
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --field-trial-handle=1808,i,518698377564684571,15258621599471653097,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1785199887200051 --launch-time-ticks=538606215 --field-trial-handle=1808,i,518698377564684571,15258621599471653097,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_Processor).Name"
  2⤵
  PID:3896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_DiskDrive | Select-Object -First 1).SerialNumber"
  2⤵
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_BaseBoard).SerialNumber"
  2⤵
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "(Get-WmiObject Win32_VideoController | Where-Object { $_.Caption -notmatch 'Microsoft Basic|Virtual|Parsec|TeamViewer|AnyDesk|VNC|VMware|VirtualBox|Hyper-V|RDP|Citrix|Indirect' } | Select-Object -First 1).Name"
  2⤵
  PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:6028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5176
- C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked by @ntpx.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\sjtweaks" --gpu-preferences=SAAAAAAAAADoABQEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,518698377564684571,15258621599471653097,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$temp = (Get-WmiObject MSAcpi_ThermalZoneTemperature -Namespace \"root/wmi\" -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature; if ($temp) { [math]::Round(($temp - 2732) / 10, 0) } else { -1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "Set-ItemProperty -Path \"HKCU:\Control Panel\Mouse\" -Name \"MouseSpeed\" -Value \"0\" -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c "$nv = (& 'nvidia-smi' --query-gpu=temperature.gpu --format=csv,noheader 2>$null); if ($nv) { $nv } else { -1 }"
  2⤵
  PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 eff0068676b894cb2e23ca6e2b8e1c336253b15a0f11e1ec2ea690b6aaa2d620
MD5 9bfc850413503d8b073d9f85b7bc22fe
SHA1 a88a764dabe27778fecaba7bc4f9a6a5c845ba09
SHA512 28f39f9104decd4c4aba40ce40d73d2d286dfcca5d96fb7c360b02f000f9acf5ca1fef73f7cb36c91ee30c9e3b0d6ab2c73704cc50830bb8020bd2b10b114cd0
TLSH
T14B112223F38C8A21CC96163A50ADAC5172B686CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 efa9df1cc403f09c022deacded6c8b49d7b10850cdfd6522ad969b4d91244efa
MD5 47e848802749997eb1d67c6b27ec48cd
SHA1 3c53adbc10e6eab9a826f31cad1446de70a42c28
SHA512 10a74a626e82f0479aefe04cbd1f4f2f17249b47d232cda10fe9e84f3745902bfe3272ba8e3052b8dd37f999caf8df98c5a4f0eca2af295fbf3b38c25de10a28
TLSH
T1F1215627B39CC961CC86163A109D9C1176B683C7809EDFDF7BC0D614A1BF999CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 259fcb785b703254d0406fb16278f04bce76abea719010e9a79e8c07d20837e9
MD5 cac79d188bf2b01951a0d02c0e920c08
SHA1 a2c3fe3a7e40dec566177787f2e20d3f753b4724
SHA512 05a4f537ba71e52d90b3a75e92f8b9eae66a7199faedcb368aadf0ba6544c30d2089e90b9799592da9422f75ec4e24edb328dc9537defc852fa9965418f8d4b6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37
MD5 b08c623a4c3d593e0197312ee60fd80b
SHA1 d758f831d82d40e2cf2b5303928840fef63c6e08
SHA512 0a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500
TLSH
T11B217427B3DCC9A1CC86163A109D9C1176B783C780AEDFDF6BC0D614A1BF998CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 a36a9813bf3b96ead474179b0a07fd96e13abc1920eb0a4828eca5fc34a27d12
MD5 393b0dd912015db6b9f455c13c931b61
SHA1 423466b784b87d0924a441df0b201be898972d5f
SHA512 b96f994b5a40b1e618886813cb5e2486ec0237de7d892ca10dbf7f441733b5161b30343de96e5b6df783373e02f14e41db5a5e63bed0aaaf907d1fb115041e0f
TLSH
T167112223F38C8920CC96163A509DAC5172B686CB81AFDF9F7FC0C210A5BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 cf0241f1a68cd89ea2098a638d262ccd1d347b033a63371325dbf82e2c74dcde
MD5 3c7ede87e259562b06b633aafd180164
SHA1 b292673ea6d8439b360a8558c3fbca3957db3b2e
SHA512 5c841e366fc16d53c7ef12fff2d007fe1bae3a8e0a6a2a44f2ea192281c132e57e34c4319a7c3cafada1c28e8117b0a3a55ac385be7d8e252d23cf0a7fb60065
TLSH
T19B112223F38C8920CC96163A509DAC5172B686CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 473079088f98bf990b6977d9ef78b9304bc0c1e1c326a497657ff5adfb089ec6
MD5 effddbda8509125f47e5a754c218fc20
SHA1 759d1bebf0099e54ffe6ddd6f5dd2c682a51646f
SHA512 4ad1ba45d95cd4de371a7a273d89a706b0cda9a521a7aaacc422a6ed2b4f66ed5a279b67699bd1ae7cfc8c523755b154db8486571348e734578358ef0c559e91
TLSH
T177112223F38C8920CC96563A509DAC5172B686DB81AFDE9F7FC0C210A1BF984CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 c99619b5acdc7217bbd262106129ea1661b531c2890476300771b706477d9734
MD5 a5ace5b1e1392854c698257bee4f3e7a
SHA1 47aed60a3a2fc5157dd62b0849a411f616fb3072
SHA512 ed15a10ff08892d8a49b04c3b208016be3f416813ed233e30c2d41ceb0720b5c987101fa4dee8d5adafcfb823784c40011f1c1aba141110f3a7a5a276e14144e
TLSH
T100112223F38C8960CC96563A509DAC5172B686CB81AFDE9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2hej5hem.ryk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2hej5hem.ryk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

evb8BA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8BA2.tmp
Size 1KB
SHA256 6f663ee9856827b7b9cf38acec4f249c5b19176f957c158131354f0abb3ccce2
MD5 e9356df67233463857c04da33ad45c38
SHA1 afcbfe5b68bea8472df7b3eaf67a86314924be51
SHA512 465b96cae86a1cb3ab25d1d740fbf86bb58c3c7d2ea64d901a8bbacb0e18978958d0649c39f809ee2ede5ce606ce3cb59e84ce455ae478b21e23608410f0695c
TLSH
T182315E13D6108AB6C15D473896E2992C26B8AC3457E916560FB0047DEC957704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb8BE2.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8BE2.tmp
Size 1KB
SHA256 09fca3fb71d25b86c409e0ecca9b6674b91b4e3b11d62b4465c9d85bfa61b37d
MD5 1c937358f29c4914ba85bae452be5741
SHA1 9800ee0e5f7c3e6a45ca94d1cbcdaafbb0183f00
SHA512 44344a0af5522ea8f11e5b3316ecc505984dcb5d72dd70de9f5b58a46f0c8aefc00311fe9595bc1bdc361566737b8d4485af1ce9b59fe4b608f73edca8e17e62
TLSH
T1B7315E12D6108AB2C14D073A96D2996C26B8AC3453E95A560FB0047DFC853304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb8C7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8C7F.tmp
Size 1KB
SHA256 e10065f646191ed62afc7af78f6be2d12d6cad8d5df3ee1bb12db6c3a92de004
MD5 9a0a215627aabfe09ec9ad1737a481a7
SHA1 d8f3a7276dfbdca98079f9c84d19b18f473caf85
SHA512 da7300a77a08de90be1a079e23a448a0c34b5138e6a3b2c488ea38a7c3844e0a7e874bb2b8eb5a2d63dfe49d1a204fa4bc243b28c4e854ac4e5ae19270998fba
TLSH
T165315E13D610CAB7C14D077896D2996C26B8AC3453E956560FB0047EEC893704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb8C80.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8C80.tmp
Size 1KB
SHA256 544dcaf37718e1cab3c22ff714c17a2b7bf6612002bf003c7d25c18b46cdc163
MD5 25b350e524e3e0b8ce553b72d58a5afc
SHA1 8085d06b7bd003ba8750bcb3a8beafeeb02bfba6
SHA512 406de80a75527ba812f300f2d9422987c2ef1d469f84ceea2802d542ecf81bd1516cefe901feba3f65749e3795280f82a2e334906b9192f4c4ccb4ea7039a9dc
TLSH
T106315E12D6108AB2C18D073896D299AC66B8AC3453E91A560FF0047DEC853704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb8C90.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8C90.tmp
Size 1KB
SHA256 7aa9ae8aaa315358c7c3c664bace1af30059014f10d15d68257e53850c75f922
MD5 d8fcced6f31829b232c999a0e0a06e17
SHA1 78f94292d460b8197a6b6d4dbdbdcbe06c3a8460
SHA512 50d18f543915374072fad2df8af0a337eed973fb8ebec77a111fb4edd90bf3b4e6d93af1133cb591b53d032b741b894a74eeac16a6dbe3a7908b88513f05f7f9
TLSH
T181315E53D6208AB2C14D077896E2992C26B8AC3453E9565A0FB0047DFC953B04A39D49
MD5 SHA1 SHA512 TLSH

Submit Download

evb8D0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8D0E.tmp
Size 1KB
SHA256 ad255b4bd994a099aa67dafe4a683a9bb4d798a7b2685781bc71236e2bed82a2
MD5 c35a793f8d969c9f76996ad984efe305
SHA1 5cdff7fd866e715af5cbc861c59d1865dc8f56c5
SHA512 0398fb216f52b2809e5c821785e68ba7b8d4f327dc2cdd3c2b3e250da7e9b45d5d6a0f48b74e3350a40e4b0f5933c8d9a1fa799312d55c170544fff1b5ebf852
TLSH
T16F315E13D610CAB2C14D073897D2992C26B8AC3463EA56560FB0047DFD857304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb8D2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8D2F.tmp
Size 1KB
SHA256 692456011577b355a60871ce16be399ed827465094aa6cdc324df1c5a1d80a88
MD5 15e0bfa26a920d10b7e7eb7c1a4858fd
SHA1 c91fe40376c5754657b1d6fb8c5302cda082b607
SHA512 cb61a0c92e679634e55d66662ab6658044bdc3a3d701c1d508f07745db1e69774e2bcb728050caf52797e968773eed4fcd5e9c38ee76554d4b9efe3c4b423819
TLSH
T1AC315E12D6108AB2C15D07389AD29A2C27B8AC3493EA17160FF004BDEC953304A39D19
MD5 SHA1 SHA512 TLSH

Submit Download

evb8EDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb8EDE.tmp
Size 1KB
SHA256 724447d07a89b5c2ae213777c9b98d3fc7f55ceeec773a9f4d5fad5988101067
MD5 61a50cd343f335d64fc6c42f87a856d7
SHA1 e84dec6baca7206a424fb6efa70b6f63d2fdbaae
SHA512 6b32a93f8247c1eb0ef436700c71fcc32487c5c401e1bf2830821d817a79d930b216854d5c70aa597762a65ae0aa459b5b697345449d32b77e5ed1d745cc9e38
TLSH
T158315E12D6108AB6C18D073897E2992C26B8AC3453E916560FB0447EEC893704A39D49
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download