393090053aab5ed73269643a2a7a4db9271da831d66d873aa25c9c5785affabb

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ralentisseur-applis.bat
Size 5KB
Sample260818-wlymxaaf39
SHA256 393090053aab5ed73269643a2a7a4db9271da831d66d873aa25c9c5785affabb
MD5 0c5121e6ca4e6dc14a4ac53a39533a49
SHA1 caee86edbdc069e5408c9b4e6078a54aea3ec893
SHA512 c8cd6815dbdeb517ed3498f736e83730cfe5d36c4d8f0fc71e5e28f55b9abbb21775cda7ddb7f3ea36a9e573f1f9fa6d3352e3fc3da71c5f3a785be9d071e33a
SSDEEP 96:i/qbWohSFMkABn5yahw4ojoMtz3o+LkoSS6cHb8PGNeF9hmAQsX/9lRLadj:UFFMkAB5VhwRtz4+LkoSS6cHAQeFPMO4
TLSH
T1C8C1A621AD4E827904B3D53BF185145BEB27021B826A4A0079EFD6D41F7531983ACFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2356	powershell.exe
3304	powershell.exe
3816	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2548	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4252	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315497584504864"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2356	powershell.exe
2356	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
2348	chrome.exe
2348	chrome.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3816	powershell.exe
3816	powershell.exe
3816	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeIncreaseQuotaPrivilege	3304	powershell.exe
Token: SeSecurityPrivilege	3304	powershell.exe
Token: SeTakeOwnershipPrivilege	3304	powershell.exe
Token: SeLoadDriverPrivilege	3304	powershell.exe
Token: SeSystemProfilePrivilege	3304	powershell.exe
Token: SeSystemtimePrivilege	3304	powershell.exe
Token: SeProfSingleProcessPrivilege	3304	powershell.exe
Token: SeIncBasePriorityPrivilege	3304	powershell.exe
Token: SeCreatePagefilePrivilege	3304	powershell.exe
Token: SeBackupPrivilege	3304	powershell.exe
Token: SeRestorePrivilege	3304	powershell.exe
Token: SeShutdownPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeSystemEnvironmentPrivilege	3304	powershell.exe
Token: SeRemoteShutdownPrivilege	3304	powershell.exe
Token: SeUndockPrivilege	3304	powershell.exe
Token: SeManageVolumePrivilege	3304	powershell.exe
Token: 33	3304	powershell.exe
Token: 34	3304	powershell.exe
Token: 35	3304	powershell.exe
Token: 36	3304	powershell.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe
Token: SeShutdownPrivilege	2348	chrome.exe
Token: SeCreatePagefilePrivilege	2348	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2356	2548	cmd.exe	90
PID 2548 wrote to memory of 3304	2548	cmd.exe	91
PID 2348 wrote to memory of 3352	2348	chrome.exe	94
PID 3304 wrote to memory of 1524	3304	powershell.exe	95
PID 1524 wrote to memory of 4756	1524	csc.exe	96
PID 2348 wrote to memory of 4252	2348	chrome.exe	98
PID 2348 wrote to memory of 1312	2348	chrome.exe	99
PID 2348 wrote to memory of 1312	2348	chrome.exe	99
PID 2348 wrote to memory of 4620	2348	chrome.exe	101
PID 2348 wrote to memory of 4620	2348	chrome.exe	101
PID 2348 wrote to memory of 4340	2348	chrome.exe	103
PID 2348 wrote to memory of 4340	2348	chrome.exe	103
PID 2348 wrote to memory of 2772	2348	chrome.exe	102
PID 2348 wrote to memory of 2772	2348	chrome.exe	102
PID 2348 wrote to memory of 5768	2348	chrome.exe	104
PID 2348 wrote to memory of 5768	2348	chrome.exe	104
PID 3304 wrote to memory of 3816	3304	powershell.exe	105
PID 3816 wrote to memory of 6060	3816	powershell.exe	107
PID 6060 wrote to memory of 2436	6060	csc.exe	108
PID 2348 wrote to memory of 1560	2348	chrome.exe	110
PID 2348 wrote to memory of 4680	2348	chrome.exe	111
PID 2348 wrote to memory of 5360	2348	chrome.exe	112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ralentisseur-applis.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$c = Get-Content -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\ralentisseur-applis.bat'; $n = ($c | Select-String -SimpleMatch ('::MOTEUR' + '-POWERSHELL')).LineNumber; $c | Select-Object -Skip $n | Set-Content -Path ($env:TEMP + '\ralentisseur-applis.ps1') -Encoding ascii"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ralentisseur-applis.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qvynxlah\qvynxlah.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES32FD.tmp" "c:\Users\Admin\AppData\Local\Temp\qvynxlah\CSC565CA830A6134BE5883532113FCEB9DA.TMP"
      4⤵
      PID:4756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ralentisseur-applis.ps1" -Resume 2348 -Name "chrome"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\otc00ioh\otc00ioh.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40B8.tmp" "c:\Users\Admin\AppData\Local\Temp\otc00ioh\CSC9B6A1218227142B39C7D2E8DE567455B.TMP"
        5⤵
        
        PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb6ce4c728,0x7ffb6ce4c734,0x7ffb6ce4c740
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,10685091287136500551,3446524887687647707,524288 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,4054617569619310856,179100861297541809,262144 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,15255868450460292881,15707770234356672095,524288 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3308,i,8112926658764179456,4190288707916973910,2097152 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,11491427526312976385,14667793271353287823,2097152 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,11706840173679444537,6211189463098351402,2097152 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,3488733407145551514,13234276446305816682,524288 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,13317916439109904216,9175329466704085982,524288 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3288,i,11408365337309357362,15776731803524870439,524288 --field-trial-handle=2008,i,2332727843482682755,14633820049278205501,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:5360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 904B
SHA256 0dadf15af90630872054f8fdb7dc4e213ecf32d6436e109f97c9162778f51e28
MD5 e2f598259c8eb971e3a614658fe08bbc
SHA1 6d382a805640335a10fdf069be8d8a05ba884f01
SHA512 aa407619e8452ce286d5c9f1d5e1649af106f53888a01993a4716001eccd2836c29014b2834ebe7e67fbc2fde3b1d8611a8c1e496930e1cdf363e8b85cd247d9
TLSH
T102119CFB8374957E8A0086E4EB05AF1FCE7A0521131C78B6C4E42D2783E28B2D00475F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c94f74254a8226149ee8729e10df5c152b22b6db3c862c191d9407ec5b23e5ba
MD5 b3d665f9d143cdc693cddf76df28971d
SHA1 7214f7cf734d85d40012d8208a56aa0c9e1df300
SHA512 2d991d4e3cc1c83d0a9d7c6dd6a30ea7aa920930854c6df988b1348b9cd5d65f5691b1767f9ae6a19cf01a33ff78edcb32c46dee20d945a94a37ae918623617a
SSDEEP 192:dRT1Ch4Uffv7hAPRp2l98Hsb+WNnu2dPZlVyIsnAUgR:dRT184Uf3AXauwbdRTR
TLSH
T16722931EBA54797B5DCBD21AF9227753E3F1102224D12E40E7FC8A6C14E7ACC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8d45d83a611cd55a5b7ec57089bd58aa9b6b04edcd357bc48fc4cb3932b594bc
MD5 760b106cc04b73e0b37d93569538b4fa
SHA1 d7bef59589b944e77c36093abeeb93b1e39a034b
SHA512 327d4d7d9c869ad900a38609af8a5dc19a6027f0533247ccd0bcf8d08d92a3f07a39eb711fdc7b92f5e01782bbcf2ceab9ad4fec0786eeda24151d047a771a70
SSDEEP 96:52C0d+oJm4V0FH+pqf+HBKyoDt3MSl8h4otop5/oDCB6xGyvkfFl65zrtkE4G07+:YC0HJm5FHuPguiU2WC9zFl6h54GqFUIC
TLSH
T15BC12BB0B4BC697309F7E781F5432583CDB462676951AF50DAE90F0D01E75E82342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 182a8aec22b73ec00acbfbfc83c822ff98cc038170b363a17159bbcd717b2186
MD5 b2338de5053d8964f0cdbfc2fe6068b9
SHA1 613e5b4558f657fe23e2defc4982fab0bc950226
SHA512 a1882ec94683a3f08ad22229979adbb16f398ac09db9080772f8166017341dd10947c1cab8f5eb82c81b5d0475f2a24973ea90ee59fc970beb2bdd05dbf5079e
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5/HDCB6eGyvkon07ob1v4a:MC0HJm5FHuPgXDUD7CW8nqobZ
TLSH
T13AA12BB1A4B94CB759B7D745F8833A83DEA4A2276991FF80D9DD1E0C01F71D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
MD5 0773347dabec51061ea4a74589125e12
SHA1 05aa0df69fe48f55680b77c79ae91b5912ca48d4
SHA512 43e24bd488c61f8b8de22a5643a668863f07b523674e94c74f6ce644b8510c58e54ee8b9d45c5f99d0523501d316b9dc8d6d44360d99e1b0b0ad88182bad6669
TLSH
T12A21AB33B3CC8724CC8A403A10CEAC1032B6C7DB409ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES32FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES32FD.tmp
Size 1KB
SHA256 f37d4f7aea845866d927b7b9f993d35dcb9d83c4b85c591022c93e31b3891e22
MD5 79d94559793fa54f01aff4050f5e55ae
SHA1 55c28fe48dca548e8fe001d0c17da55dbb9c11e7
SHA512 a2437003620ee963d22e5164409fdec84688f4eae9ef5640da27176b730d5a0424c45bf4705ba069b737e7cfb26dacad18a8363cd8fd520f87a4b17157634373
TLSH
T1FE21CC0547E9871AF07347316DF6132F9278FE54EFB1575A494002292C41504EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES40B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES40B8.tmp
Size 1KB
SHA256 6a13b8f58816f059ab2088be3b17cf8220b4d60d555c1c009781679cd369ee64
MD5 5077bef32d6896edda9c50f407e780b2
SHA1 d25abe72425551e29636ff39571e5544174513f8
SHA512 9ff21237e6660954419e17afa3bd5a4fd3e192479ced6a739b3399d060dd21d29c6ee1fb54835ada386122708953712f15d3fbd15dd7e7abcff8f351f65593cf
TLSH
T1C4218C0693ED471FF073473169F9072F9675FD55EFA1A36A8440022D2C52504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0ulkfhgf.5yw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ulkfhgf.5yw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

otc00ioh.dll

Path C:\Users\Admin\AppData\Local\Temp\otc00ioh\otc00ioh.dll
Size 3KB
SHA256 05c0b897a86d04ba86d294c284af9690aa418881480c3c2efa82539a9e9ee5cb
MD5 f843119a4035ab4e93f1978a39641486
SHA1 2ac5036262ca6bdb2894dad65b41c2b75fff6c15
SHA512 3a55668cffebb649548ddd3b0383f5131b1e7741e81009b9ab0fb650c807a7107990409b6c95d59a4bdee7065fcfcfd9577a75cccf577c7a070362b9a7b1fda6
TLSH
T13471DA0BDBE84626E4BB4734AEF307176BF0F8508B73936A098103296DA16241A31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

qvynxlah.dll

Path C:\Users\Admin\AppData\Local\Temp\qvynxlah\qvynxlah.dll
Size 3KB
SHA256 4fa746ac1d8e2c32bdfdc150522ab36918c7c16a62e265b675bc06f36bb8c2b9
MD5 eadc3cf95dc50b5b5ac272fc73cb4e50
SHA1 7dd25743d45f4ac1a33f8410b25b89d6cd2b1ddd
SHA512 4ae1f7d1b1f353ad3949671d2653d48e55fa733eacb73e6fadd338df00ccfc3083d5cb024f1bf3b18a1d36a79d9569240d904559fcd7f52eea8809b9e12d1126
TLSH
T15F71CB17DBE88626E4BB4B78AEF3071767F4FC508B73932B198102296D912200E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

ralentisseur-applis.log

Path C:\Users\Admin\AppData\Local\Temp\ralentisseur-applis.log
Size 142B
SHA256 a280aa086eb670325224b3ed343c6dd9bc4baaa694baf909678d500fe14ede80
MD5 fa249af48a4e17f9e04e468fda33cd41
SHA1 71afb1235637f84e9fbd0244a90d677325a939b4
SHA512 60dac1030d096bc5fff3ed1365addf05d484dfd8d8d582bd728b19cb1b21924cf5f4619e219be9fa13c4d00229abe3c5836d1c8270d2856a2d0c9e23a34d8412
TLSH
T173C048207EAA42986DA3160E857CAA17645373BA901EDA1FB7BC06D800820878E64B94
MD5 SHA1 SHA512 TLSH

Submit Download

ralentisseur-applis.ps1

Path C:\Users\Admin\AppData\Local\Temp\ralentisseur-applis.ps1
Size 4KB
SHA256 0fcd5d6dd5f4fdb16a05a45b874fc3b723272300dd6c7bd0a53ab6d23ba5e239
MD5 f6e775d91b5dd3e6a3b55f0abe9fd6ae
SHA1 4acd7fd2252f5e723197c6774732b1a1de417428
SHA512 9864f1f20ac3c5213033bd7d33ab32235eed503c9395621290c67c21b31ea56d32fc91d329d47f600640a970d8767d17b1b1e0dc987c23d781359d309d98bb8b
SSDEEP 96:MPn5yahw4ojoMtz3o+LkoSS6cHb8PGNeF9hmAQsX/9lRLadj:g5VhwRtz4+LkoSS6cHAQeFPMO/9Dadj
TLSH
T1DEA1A511AD5EC27900B7963BF586145BEB27012B416F4A10B5FED2941FB430A836CFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9B6A1218227142B39C7D2E8DE567455B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\otc00ioh\CSC9B6A1218227142B39C7D2E8DE567455B.TMP
Size 652B
SHA256 5da60d074bd070e24b483ae25b11ec77f38a6c12396057648375c69cf7c2de16
MD5 678a1b95fcac21bb37fcf258cbc76aa6
SHA1 c80f5933135c777e80a21bfc41a7403ddfce6d73
SHA512 4d0db42f970d62e116073e3a745ddcebed19881fe58742df51b092de1b9d17ffa740e8bc0fd1e38bafb362292b7c4325a223c5af12cc41b68311802a1cdb7d6e
TLSH
T16FF05E0963F8020EF4F34B30BEF6436395B9BC64DE3293ED1440035D68649109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

otc00ioh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\otc00ioh\otc00ioh.cmdline
Size 369B
SHA256 5c3b32f1207a0b5a89f7f032b63e1fdc640e2a14f693f7f1cb6b18f71e4789e2
MD5 7f5dbf29553554712aaa62a94fb37231
SHA1 3c41dc27bc3ffbb4abea46bf686f84181623d342
SHA512 6a98037ceb55e79f3aef50d968a114d60126cb9b1a618ec899928b62b0a9345e2df819ff07a409bc83e7906cf44f6e0ab0105f22fde43748569ad96ec15da4e5
TLSH
T1C6E0C03A524AC27D07DD100B2169C7ACD372078B3A40FF846040480ED16B80827F1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC565CA830A6134BE5883532113FCEB9DA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qvynxlah\CSC565CA830A6134BE5883532113FCEB9DA.TMP
Size 652B
SHA256 5b7be9229a0053f91433d4c7abce4b8f482852a53dae614675b42cdd12b3683d
MD5 d419a2212fd3de7966510547df1fd283
SHA1 301a95ead11659472175bf55ae14d240a14f614c
SHA512 86449d7e975681a277028f8c44352f6f8d56a679238bbc0f1009bd9fc39041821d5cdcfb34e6ce883a739b7003971a1035cbfd1430686185cea52fa538273d90
TLSH
T158F05E0967F8420EF0F74B70BEF6436391ADBC64DE7293ED25501729286451089A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qvynxlah.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qvynxlah\qvynxlah.0.cs
Size 548B
SHA256 812878e3e16bc3466979e6605b6569e526f67f3546e79f5050446b3efebc62c7
MD5 4f94b885f69bbd87910be9407077669b
SHA1 09f68eaae9f782fd363e7fdef088594f533b6bb3
SHA512 de5e48d8fbef64a07e7602318c27ec08484c2f36367d2e7e906bd8ff4a07c723bbb33f0731c89e9a44632670bec3091315590b47e183a11849a07c2948ac1d16
TLSH
T1BAF0243C618AEBA484BA400AB851D4EFFE432022137B2B11B7A567320F2B1856778A1D
MD5 SHA1 SHA512 TLSH

Submit Download

qvynxlah.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qvynxlah\qvynxlah.cmdline
Size 369B
SHA256 2ee7dd8727779884de4b4fe027dd5dd9c2fe7ea5ddd2ab22bde80d0493f027e4
MD5 80afdc95de823d0b67ad5126e24dc770
SHA1 da3a39edfce0461f294cdf2a02a4edc6d29d26c3
SHA512 be8da20451bb1df1e3f2a5ae38ddf97dbc7d0a6bce23ea5eb93ac4c67d2bc13caf0ecdc93bbed47689ecd0e95458d46c3be10149935e782e681e6082cca04073
TLSH
T144E0683E4346C67D26DF10172169F8ACC2B21EC36B423F845940444DD0374012FD1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2356-5-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-6-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-7-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-8-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-9-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-12-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-13-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-0-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp

Download

memory/2356-3-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/2356-4-0x0000027EB4C70000-0x0000027EB4C92000-memory.dmp

Download

memory/3304-20-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-97-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-16-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-49-0x000002BBCA300000-0x000002BBCA32A000-memory.dmp

Download

memory/3304-15-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-50-0x000002BBCA300000-0x000002BBCA324000-memory.dmp

Download

memory/3304-48-0x000002BBC9DA0000-0x000002BBC9DAA000-memory.dmp

Download

memory/3304-14-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-24-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-47-0x000002BBC9FC0000-0x000002BBCA072000-memory.dmp

Download

memory/3304-96-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-17-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-98-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-46-0x000002BBC9D80000-0x000002BBC9D9E000-memory.dmp

Download

memory/3304-25-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-43-0x000002BBB1B90000-0x000002BBB1B98000-memory.dmp

Download

memory/3304-21-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-28-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-23-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3304-26-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3816-94-0x000001D656230000-0x000001D656238000-memory.dmp

Download