77b82fd3c528fbc17237caa9eb741ff85a6ef159cbdfa7b9cfe2c9f841e87662

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SoftPlayer6283.exe
Size 164.7MB
Sample260804-a39wlsac48
SHA256 77b82fd3c528fbc17237caa9eb741ff85a6ef159cbdfa7b9cfe2c9f841e87662
MD5 1fc9e3e95deb2f93dbbbe6a44c1cca88
SHA1 b929cb194419a9a7a06bf31f89854c5a76fe7c60
SHA512 553b5adf52b8ba5fdd193753cb67ac38f47c583456522f7d19038442ae6af941c897cd84809fd8437ebc0c5e270268c3cd4821edd3f29dbb8e29080e91ad3b73
SSDEEP 1572864:UmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQD:qsFWY7ihS4kVP
TLSH
T158888C03F29650E9F05DD1B18B578236EA72B8861738A6DF175417262F7BFE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	powershell.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe

Looks for VirtualBox drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vboxvideo.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxguest.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxmouse.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vboxsf.sys	SoftPlayer6283.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe
544	powershell.exe
1648	powershell.exe
748	powershell.exe
1668	powershell.exe
3204	powershell.exe
2984	powershell.exe
2248	powershell.exe
4948	powershell.exe
4244	powershell.exe
5604	powershell.exe
4060	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe

Looks for VMWare drivers on disk 2 TTPs 5 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmemctl.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SoftPlayer6283.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SoftPlayer6283.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5604	powershell.exe
2984	powershell.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2616	powershell.exe
544	powershell.exe
544	powershell.exe
2616	powershell.exe
1648	powershell.exe
1648	powershell.exe
2248	powershell.exe
2248	powershell.exe
4948	powershell.exe
4948	powershell.exe
2616	powershell.exe
4244	powershell.exe
4244	powershell.exe
748	powershell.exe
748	powershell.exe
5604	powershell.exe
5604	powershell.exe
4060	powershell.exe
4060	powershell.exe
1668	powershell.exe
1668	powershell.exe
2984	powershell.exe
2984	powershell.exe
3204	powershell.exe
3204	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe
Token: 33	2616	powershell.exe
Token: 34	2616	powershell.exe
Token: 35	2616	powershell.exe
Token: 36	2616	powershell.exe
Token: SeShutdownPrivilege	1164	SoftPlayer6283.exe
Token: SeCreatePagefilePrivilege	1164	SoftPlayer6283.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe
Token: 33	2616	powershell.exe
Token: 34	2616	powershell.exe
Token: 35	2616	powershell.exe
Token: 36	2616	powershell.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 5776	1164	SoftPlayer6283.exe	84
PID 1164 wrote to memory of 5776	1164	SoftPlayer6283.exe	84
PID 1164 wrote to memory of 5356	1164	SoftPlayer6283.exe	85
PID 1164 wrote to memory of 2616	1164	SoftPlayer6283.exe	86
PID 1164 wrote to memory of 544	1164	SoftPlayer6283.exe	87
PID 1164 wrote to memory of 1648	1164	SoftPlayer6283.exe	91
PID 1164 wrote to memory of 2248	1164	SoftPlayer6283.exe	94
PID 1164 wrote to memory of 4948	1164	SoftPlayer6283.exe	96
PID 1164 wrote to memory of 4244	1164	SoftPlayer6283.exe	99
PID 1164 wrote to memory of 748	1164	SoftPlayer6283.exe	101
PID 1164 wrote to memory of 5604	1164	SoftPlayer6283.exe	103
PID 1164 wrote to memory of 4060	1164	SoftPlayer6283.exe	105
PID 4060 wrote to memory of 5496	4060	powershell.exe	107
PID 5496 wrote to memory of 3808	5496	csc.exe	108
PID 1164 wrote to memory of 1668	1164	SoftPlayer6283.exe	109
PID 1164 wrote to memory of 5968	1164	SoftPlayer6283.exe	111
PID 1164 wrote to memory of 2984	1164	SoftPlayer6283.exe	113
PID 1164 wrote to memory of 3204	1164	SoftPlayer6283.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe
"C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe"
1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe
  "C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher-build" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1676 --field-trial-handle=1680,i,2125411590998250901,12240334473077758577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5776
- C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe
  "C:\Users\Admin\AppData\Local\Temp\SoftPlayer6283.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\launcher-build" --mojo-platform-channel-handle=2092 --field-trial-handle=1680,i,2125411590998250901,12240334473077758577,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:5356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' $cs=Get-CimInstance Win32_ComputerSystem;$bios=Get-CimInstance Win32_BIOS;$bb=Get-CimInstance Win32_BaseBoard $mem=Get-CimInstance Win32_PhysicalMemory;$disk=Get-CimInstance Win32_DiskDrive;$vid=Get-CimInstance Win32_VideoController $net=Get-CimInstance Win32_NetworkAdapter -Filter \"PhysicalAdapter=True\";$enc=Get-CimInstance Win32_SystemEnclosure $os=Get-CimInstance Win32_OperatingSystem;$proc=(Get-Process).Name;$tz=0;$tp=0 try{$tz=@(Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA SilentlyContinue).Count}catch{} try{$tp=@(Get-CimInstance Win32_PerfFormattedData_Counters_ThermalZoneInformation -EA SilentlyContinue).Count}catch{} $bat=@(Get-CimInstance Win32_Battery -EA SilentlyContinue|Select Name,BatteryStatus,EstimatedChargeRemaining,Chemistry) [pscustomobject]@{CS=$cs|Select Manufacturer,Model,HypervisorPresent;BIOS=$bios|Select Manufacturer,SerialNumber,Version,SMBIOSBIOSVersion Board=$bb|Select Manufacturer,Product,SerialNumber;Mem=$mem|Select Manufacturer,PartNumber,SerialNumber,Capacity Disk=$disk|Select Model,InterfaceType,SerialNumber,Size;Video=$vid|Select Name,AdapterCompatibility,AdapterRAM,VideoProcessor,PNPDeviceID Net=$net|Select Name,MACAddress,Manufacturer;Enc=$enc|Select Manufacturer,Model,ChassisTypes,SerialNumber OS=$os|Select Caption,Version,RegisteredUser,InstallDate;Proc=$proc;Thermal=@{Zones=$tz;Perf=$tp};Battery=$bat }|ConvertTo-Json -Depth 5 -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions\""
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VBoxGuest\""
  2⤵
  - Enumerates VirtualBox registry keys
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmci\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare services registry key.
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmhgfs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Test-Path \"Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' $n=0 $paths=@( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' ) foreach($p in $paths){ Get-ItemProperty $p -ErrorAction SilentlyContinue | ForEach-Object { if($_.DisplayName -and ($_.DisplayName.ToString().Trim())){$n++} } } Write-Output $n "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' Add-Type -TypeDefinition @\" using System; using System.Runtime.InteropServices; public class KanziSmbios { [DllImport(\"kernel32.dll\", SetLastError=true)] public static extern uint GetSystemFirmwareTable(uint sig, uint id, IntPtr buf, uint size); } \"@ $sig = 0x52534D42 $size = [KanziSmbios]::GetSystemFirmwareTable($sig, 0, [IntPtr]::Zero, 0) if ($size -lt 8) { Write-Output \"\"; exit } $ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([int]$size) try { $got = [KanziSmbios]::GetSystemFirmwareTable($sig, 0, $ptr, $size) if ($got -lt 8) { Write-Output \"\"; exit } $bytes = New-Object byte[] $got [System.Runtime.InteropServices.Marshal]::Copy($ptr, $bytes, 0, [int]$got) $data = $bytes[8..($got-1)] $count = 0; $i = 0 while ($i + 4 -le $data.Length) { $length = $data[$i+1] if ($length -lt 4 -or $data[$i] -eq 127) { break } $count++ $i += $length while ($i + 1 -lt $data.Length) { if ($data[$i] -eq 0 -and $data[$i+1] -eq 0) { $i += 2; break } $i++ } } Write-Output $count } finally { [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ptr) } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w2hb005y\w2hb005y.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64C0.tmp" "c:\Users\Admin\AppData\Local\Temp\w2hb005y\CSC8A3C14B0385142559FE3D1E9FB2C87D.TMP"
      4⤵
      PID:3808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference='SilentlyContinue';$ts=(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate;Write-Output $ts"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Windows\system32\schtasks.exe
  schtasks /Query /FO CSV /NH
  2⤵
  PID:5968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference='SilentlyContinue' $ignore=@('securityhealth','ctfmon','sidebar','windowsdefender','rthdcpl','igfxtray','hotkeyscmds','nvbackend','electron') $n=0 $paths=@( 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run' ) foreach($p in $paths){ $item=Get-ItemProperty $p -ErrorAction SilentlyContinue if($null -eq $item){continue} $item.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object { $low=$_.Name.Trim().ToLower() if($low -and ($ignore -notcontains $low) -and -not $low.StartsWith('microsoft')){$n++} } } Write-Output $n "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37
MD5 b08c623a4c3d593e0197312ee60fd80b
SHA1 d758f831d82d40e2cf2b5303928840fef63c6e08
SHA512 0a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500
TLSH
T11B217427B3DCC9A1CC86163A109D9C1176B783C780AEDFDF6BC0D614A1BF998CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 920b0533da0c372d9d48d36e09d752c369aec8f67c334e98940909bfcb6c0e6c
MD5 e89c193840c8fb53fc3de104b1c4b092
SHA1 8b41b6a392780e48cc33e673cf4412080c42981e
SHA512 865667a22e741c738c62582f0f06ea4559bb63a1f0410065c6fb3da80667582697aba2e233e91068c02d9ab4fb5db282a681fe8234f4c77a5309b689a37ac3a2
TLSH
T1D7117627F39CCA21CC96153A409DAD1172B683DB81AEDF9F6FC0D215A07F584CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 06131bf4d4fe55b1f4bbc16d84a994b1b0891d4459bc1c5b05a8cec3725ebb27
MD5 20810d165c316378abc650cfa1e8d26a
SHA1 1e93a79cbb16e8836bc669ecbff8bd614b8fd05b
SHA512 58fc8a24e40ab9051739ee47d99d69a24bf0ec1755a507b13fd76df47395c97a140aa56f1f4de3a0fc848216fc6f32c7e191aa862848c65226eba5c3697aa098
TLSH
T1B121A827B3DC8921CC86163A109D9C1172B683C7809EDF9F6FC0D600A07F598CB31190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 66413c748bcee7c0d68a171fceb33dcc7de85ec69837e68ba391d46d7ce6c1e3
MD5 d2bf719e645fba1f6ab823e6ef207b13
SHA1 3e71ec1627eb6eab817878f918eba1fe63880210
SHA512 5f19086a8c9d8a4269a337a265e0f93be4e2c9c982e32e7c636184c8f9cd56d19b3c6d5b02aaee337a16f3617071fe8d57267f398b44978458ee686064a00e87
TLSH
T1D3215627B39CC961CC86163A109D9C1176A683C7809EDFDF6BC0D614A1BF998CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4ee75b9bd85c06e1b58c54155ab27230c46345559d353fb0582a9592839432f1
MD5 67c92df588047cbc080a443367781b38
SHA1 7d5fe87cce0d407a82ba29da7ec1a441fac44a74
SHA512 47e99be1e08cc677ac24b14d55ac5c6f63f115c441e29bb1ce316673a199df23522bfd0dc615d05d397bb1a99cfb76044a88421702d4ca5b056bd803d690e5af
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

RES64C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES64C0.tmp
Size 1KB
SHA256 4bff2a9a89184507a6a0d567b3bbc4c44108bc33210867e4de66f877fda53ee7
MD5 406828d2688f52050bd663a021dc50e9
SHA1 3fb0a548de09af4a8d8b2c67d50dcfb67a7c752b
SHA512 af38d4ed68c98997ea8340834e8a951cd8945285d62d3d8ce17457e0fba79a96749f1e55d9cce987a46d8c52a363a5e0b29e2b2d0cd2c4ffb9f02f7ca4f54c4b
TLSH
T10321AF0593E84B1FF0B7473169FA172FA278FD54EFA2536B844542281C61144FEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_j2bvvru0.1e5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j2bvvru0.1e5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

w2hb005y.dll

Path C:\Users\Admin\AppData\Local\Temp\w2hb005y\w2hb005y.dll
Size 3KB
SHA256 5498fb1a258523aea0e2ae9c072828c745bcfa3568267078f515289292615fa7
MD5 176df2d52169a34a9464275b86b305c7
SHA1 5f6ec730acf46adc9d0facbdcb3ae5f98cad7dba
SHA512 49993634748f762d6627b262f60d17b0c54521775078f3497f28792da767e02e48ff621fd25ebc8cf0ffe219e171103b431c4d4ef4a7a38a9cb5f8bf9f027427
TLSH
T1CA51AA1AA3E84A6BE4BB47316EF3435727B4F8109B6267690880432CAC603681E71BB0
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\launcher-build\Network\Network Persistent State
Size 300B
SHA256 51c5f3564747a009c4f3648a03834169b58d58769aa2fa744ef6693753866d3b
MD5 f215ec5c50871f6be390227e997f8089
SHA1 5c4d2c2d5c5dbd16d031e0ad2f3cb02404beb027
SHA512 c219665e1ecaea0a273791e9cb80f8d2bf469545c98f5abfcbcec3955dd8dc209f915aefb60faf8c2e4f67e2c6597d4c27b6e00c11dd9a37f6cc56ba0e8ad14f
TLSH
T12FE0EBA7C2D86CBE078583F42B253D13C2BE080A522C3E06C9E8BB1E43F28BC490044F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe588894.TMP

Path C:\Users\Admin\AppData\Roaming\launcher-build\Network\Network Persistent State~RFe588894.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8A3C14B0385142559FE3D1E9FB2C87D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w2hb005y\CSC8A3C14B0385142559FE3D1E9FB2C87D.TMP
Size 652B
SHA256 df1958e631dbe1716768eea3e5ab4b3b77b646da5d45c4c37c70563f97e74aef
MD5 9a08f560c786c2b87eafd00ad0ef30a2
SHA1 b1417cb3e51763a283adb3447c2bb3220f301270
SHA512 38cbc27c56c35b7d4b4460f8e79464e39ffafc6a13aa5650402b0db7bc4e71d0476a3c2c98a8b605698ca59c3aea31f099da788e050bd0b1322bcd5441be224f
TLSH
T19BF05E0A63F8020EF0F74B30BDF653A7A1A8BC64DE3293FD1494031928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

w2hb005y.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w2hb005y\w2hb005y.0.cs
Size 226B
SHA256 557ab1b5120f4dfb46b21503fbd9814df57b5fb71df988070c26e2d5e298e798
MD5 e0ff79f719703b75f5a44f7df89866ad
SHA1 84459e291f17030f85dbcce02dfff78e223eb5f5
SHA512 b7178e36c24709b7687bb8158899ea8bf124b7fa38b92f531dc7892037d1490c032c81f8e873017704ff24c8fdf0563e3d8defa6ec19bb2c1cf13c0601cf1bc1
TLSH
T1CDD0972837A7A2B69006801A0E05F58CFB13C21002B42800CAEC0212CC822085A70E36
MD5 SHA1 SHA512 TLSH

Submit Download

w2hb005y.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w2hb005y\w2hb005y.cmdline
Size 369B
SHA256 4f7aad2a7c91e8b6727a4e7dd5eb3af759e611798328f04a722f354eb2d63e7b
MD5 12ecd5633a5dee7207334fffe35a72c4
SHA1 2fa2d89eed5852cd5d43caa6ef3058e2a84e8e53
SHA512 51d6f881591eb557167c344406b941f2e6d8af78f532681c614a87fc5bce4f4b9b2870b2ac05dee2ec85d3193894acc69d14d672b4905ef7d4167616ccc4d8e7
TLSH
T184E0D82A525ACABD95FD104721B9C5AC8272078739C17F846152C85DD01B04CA7D3756
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2616-55-0x000001BCB88E0000-0x000001BCB890A000-memory.dmp

Download

memory/2616-40-0x000001BCB83F0000-0x000001BCB8412000-memory.dmp

Download

memory/2616-56-0x000001BCB88E0000-0x000001BCB8904000-memory.dmp

Download

memory/4060-132-0x000002B916D50000-0x000002B916D58000-memory.dmp

Download