799502ee36b7dd851a3843083ba16b4b2f45a45a7684185d0d733a636e734662

Analysis

max time kernel
298s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
حل مشاكل/حل مشكله شاشه CRU.bat
Size 1KB
Sample260824-p5dnhsde33
SHA256 799502ee36b7dd851a3843083ba16b4b2f45a45a7684185d0d733a636e734662
MD5 7997c1826abdbe73ea16118259e71551
SHA1 32f184a63defab57adc7df05e3da44131aabc6cf
SHA512 0fdc01efa39194691146d98b2f93b973d4a9f646fe6d2359e3ba83692a94964a460a4fea37f26eadc9a2dbd21280f7876a7b516bf291dc6457dcc7877f8f55a3
TLSH
T1F041F1233E517D9C0682C647DAA46703FE7D1C8B10835EC5B8E242B06E62F94A27CB8D
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4232	powershell.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4620	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
840	cmd.exe
968	cmd.exe
4324	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4232	powershell.exe
4232	powershell.exe
4620	powershell.exe
4620	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeIncreaseQuotaPrivilege	4620	powershell.exe
Token: SeSecurityPrivilege	4620	powershell.exe
Token: SeTakeOwnershipPrivilege	4620	powershell.exe
Token: SeLoadDriverPrivilege	4620	powershell.exe
Token: SeSystemProfilePrivilege	4620	powershell.exe
Token: SeSystemtimePrivilege	4620	powershell.exe
Token: SeProfSingleProcessPrivilege	4620	powershell.exe
Token: SeIncBasePriorityPrivilege	4620	powershell.exe
Token: SeCreatePagefilePrivilege	4620	powershell.exe
Token: SeBackupPrivilege	4620	powershell.exe
Token: SeRestorePrivilege	4620	powershell.exe
Token: SeShutdownPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeSystemEnvironmentPrivilege	4620	powershell.exe
Token: SeRemoteShutdownPrivilege	4620	powershell.exe
Token: SeUndockPrivilege	4620	powershell.exe
Token: SeManageVolumePrivilege	4620	powershell.exe
Token: 33	4620	powershell.exe
Token: 34	4620	powershell.exe
Token: 35	4620	powershell.exe
Token: 36	4620	powershell.exe
Token: SeIncreaseQuotaPrivilege	4620	powershell.exe
Token: SeSecurityPrivilege	4620	powershell.exe
Token: SeTakeOwnershipPrivilege	4620	powershell.exe
Token: SeLoadDriverPrivilege	4620	powershell.exe
Token: SeSystemProfilePrivilege	4620	powershell.exe
Token: SeSystemtimePrivilege	4620	powershell.exe
Token: SeProfSingleProcessPrivilege	4620	powershell.exe
Token: SeIncBasePriorityPrivilege	4620	powershell.exe
Token: SeCreatePagefilePrivilege	4620	powershell.exe
Token: SeBackupPrivilege	4620	powershell.exe
Token: SeRestorePrivilege	4620	powershell.exe
Token: SeShutdownPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeSystemEnvironmentPrivilege	4620	powershell.exe
Token: SeRemoteShutdownPrivilege	4620	powershell.exe
Token: SeUndockPrivilege	4620	powershell.exe
Token: SeManageVolumePrivilege	4620	powershell.exe
Token: 33	4620	powershell.exe
Token: 34	4620	powershell.exe
Token: 35	4620	powershell.exe
Token: 36	4620	powershell.exe
Token: SeIncreaseQuotaPrivilege	4620	powershell.exe
Token: SeSecurityPrivilege	4620	powershell.exe
Token: SeTakeOwnershipPrivilege	4620	powershell.exe
Token: SeLoadDriverPrivilege	4620	powershell.exe
Token: SeSystemProfilePrivilege	4620	powershell.exe
Token: SeSystemtimePrivilege	4620	powershell.exe
Token: SeProfSingleProcessPrivilege	4620	powershell.exe
Token: SeIncBasePriorityPrivilege	4620	powershell.exe
Token: SeCreatePagefilePrivilege	4620	powershell.exe
Token: SeBackupPrivilege	4620	powershell.exe
Token: SeRestorePrivilege	4620	powershell.exe
Token: SeShutdownPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeSystemEnvironmentPrivilege	4620	powershell.exe
Token: SeRemoteShutdownPrivilege	4620	powershell.exe
Token: SeUndockPrivilege	4620	powershell.exe
Token: SeManageVolumePrivilege	4620	powershell.exe
Token: 33	4620	powershell.exe
Token: 34	4620	powershell.exe
Token: 35	4620	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1276	840	cmd.exe	88
PID 1276 wrote to memory of 1028	1276	net.exe	89
PID 840 wrote to memory of 968	840	cmd.exe	90
PID 968 wrote to memory of 1488	968	cmd.exe	91
PID 968 wrote to memory of 2692	968	cmd.exe	92
PID 840 wrote to memory of 2552	840	cmd.exe	93
PID 840 wrote to memory of 2636	840	cmd.exe	94
PID 840 wrote to memory of 2044	840	cmd.exe	95
PID 840 wrote to memory of 628	840	cmd.exe	96
PID 840 wrote to memory of 4840	840	cmd.exe	97
PID 840 wrote to memory of 5068	840	cmd.exe	98
PID 840 wrote to memory of 4492	840	cmd.exe	99
PID 840 wrote to memory of 4592	840	cmd.exe	100
PID 840 wrote to memory of 4944	840	cmd.exe	101
PID 840 wrote to memory of 3044	840	cmd.exe	102
PID 840 wrote to memory of 4988	840	cmd.exe	103
PID 840 wrote to memory of 3184	840	cmd.exe	104
PID 840 wrote to memory of 4304	840	cmd.exe	105
PID 840 wrote to memory of 2260	840	cmd.exe	106
PID 840 wrote to memory of 1128	840	cmd.exe	107
PID 840 wrote to memory of 4960	840	cmd.exe	108
PID 840 wrote to memory of 4132	840	cmd.exe	109
PID 840 wrote to memory of 3428	840	cmd.exe	110
PID 840 wrote to memory of 1448	840	cmd.exe	111
PID 840 wrote to memory of 1860	840	cmd.exe	112
PID 840 wrote to memory of 4324	840	cmd.exe	113
PID 4324 wrote to memory of 3832	4324	cmd.exe	114
PID 4324 wrote to memory of 1260	4324	cmd.exe	115
PID 840 wrote to memory of 4232	840	cmd.exe	116
PID 840 wrote to memory of 4620	840	cmd.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\حل مشاكل\حل مشكله شاشه CRU.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" | findstr /i "00"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}"
    3⤵
    PID:1488
- - C:\Windows\system32\findstr.exe
    findstr /i "00"
    3⤵
    PID:2692
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\EDID_OVERRIDE" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "NV_ModeList" /f
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "CustomModes" /f
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:628
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "FreeSyncMinHz" /f
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000\EDID_OVERRIDE" /f
  2⤵
  PID:5068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "NV_ModeList" /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "CustomModes" /f
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:4944
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "FreeSyncMinHz" /f
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\EDID_OVERRIDE" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "NV_ModeList" /f
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "CustomModes" /f
  2⤵
  PID:4304
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:2260
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "FreeSyncMinHz" /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties\EDID_OVERRIDE" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "NV_ModeList" /f
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "CustomModes" /f
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:1448
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "FreeSyncMinHz" /f
  2⤵
  PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" /s | findstr /i "EDID_OVERRIDE"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" /s
    3⤵
    PID:3832
- - C:\Windows\system32\findstr.exe
    findstr /i "EDID_OVERRIDE"
    3⤵
    PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Set-DisplayResolution -Width 1920 -Height 1080 -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display -ErrorAction SilentlyContinue | ForEach-Object { Disable-PnpDevice -InstanceId $_.InstanceId -Confirm:$false -ErrorAction SilentlyContinue; Enable-PnpDevice -InstanceId $_.InstanceId -Confirm:$false -ErrorAction SilentlyContinue }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x240 0x468
1⤵
PID:3324

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 f149767fafdce052a2f027fb96e84c4e5a5131441427cfcca3b05bdc3277ee28
MD5 881e81016da282ea259ed28559cd6269
SHA1 c74b67c1e2bbe1cd7e4e490b9ebe6110c6cf73dc
SHA512 9de8a4be13c67fede9629e8d93f08f75cbd89839759859f7deb5b6f02cdb86542fcf2f4fcbdde90d7e0ba9abece2a92e26d3c3abf978341badd980a4c86582f1
TLSH
T158114523F38C8920CC96163A509DAC5172B686CB81AFDF9F7FC0C210E1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_acc4zo45.f11.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_acc4zo45.f11.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 142KB
SHA256 55b47d0f965800c179a78314b6489d02788a44fa2ce00f68b2d860440216927a
MD5 1bd26a75846ce780d72b93caffac89f6
SHA1 ff89b7c5e8c46c6c2e52383849bbf008bd91d66e
SHA512 4f5e14637e9e89700f1ee2d0e575d26d4f3d164d859487f1471bf4410dec6d0d7dbf552c6f791c12388be035c6b974610cda8882c6394438e2220b79e4d74e9e
SSDEEP 3072:wb+j2tTPhtq3LnfxNlu9rinu2xo17pYopTdelMTdlPf90DG:4
TLSH
T1C5E314610BE90518F2F77F38AAF54085AE6AFDA6BE32D81D1150118E05B3E11DCB5B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 151KB
SHA256 861ae83b1370c2c81992448c836914ff0048c77ecfc0db5a2ab2f270fa83b354
MD5 2c9b8ee7c824bfbbd92303fe8bdecb14
SHA1 db69f24656a48dce12096847720ee82df20ddb72
SHA512 fd4c70ee88ed7d969ddfa8927cc06f555d202cc40b9e30026d93f93214d7d8b3d1fbbd8d84deb4f1593e455e9d3c9fc5196ee303299f7d8c7a8421d686021f78
SSDEEP 1536:jLLxUhWnjnfMIlk9dsN2Lol73y4T5TqtMZuh6f90D6:XLJnfMIlk9dsN2Lol73y4T5xf90D6
TLSH
T1BEE39B605BF81206F2F7BF38AAFA05555E3ABD56AD36D41D0160128E0DB2F41DCB872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 145KB
SHA256 e7dbea4a3e397380071fea2de077b26a272c6de222b4a0356e7806a19851ef8d
MD5 65040bcab359f3c3645afd415e1bbf24
SHA1 c74757dab3373a70407f2978b8bb4aa42ea3f327
SHA512 48585e71dc20af8eeedc8cc7f597529dcccba297eb3567cb07e8b2ac22ca52383c52a6f91cab7fa5dd04c29e7b8bdb9db4026bc6100e9c5d10d30fcd6dee0dfd
SSDEEP 1536:SkD6nfVQlg9ZDH2lo57Eu5kIgdmqtMZuh6f90D6:SkD6nfVQlg9ZDH2lo57X5kIgd6f90D6
TLSH
T116E3ACA55BF80115F2F7BF38A9FA11429E6ABD6BAD32D41D0190018E08B2F51DCB9737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 142KB
SHA256 7903d8ac24acd9853ffc8dd540afe67d601cc08136c6efcefbe2b89c9d1e596d
MD5 1bf6a03158b80ea719ffe799fb4bae97
SHA1 322d4cdd59ce3b0d8e6449ecde33986d11bb4aab
SHA512 256f3cdc611dbed0ea11d6b1020f49d030e7b51b10186fa8d1115bff577da2fc79dbe3a7bc69cb72f6ac6fdd0db0ad8e3f54a4f78910a141ea427dc5191bd658
SSDEEP 3072:0A67APRnfTIlv9T/E2do37H6Xx8ECf90D6:d
TLSH
T196E3BDA15BF81108F2F77F3CAAB951525E3ABE66AE31D42D0190018F09B2E51DCB573B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc011.dat

Path C:\Windows\System32\perfc011.dat
Size 125KB
SHA256 9f32176066529c5699d45728fcad1bccce41d19dded4649b49cb24f7eef9ce7f
MD5 eef14d868d4e0c2354c345abc4902445
SHA1 173c39e29dbe6dfd5044f5f788fa4e7618d68d4d
SHA512 c926f13a0fc900dd7d740e2d7d33cdd1902ece0bfb44b6e1f5fed6ffd348c3e7d71089fb9792e38799e8df6573bc09e67bbe132cf9c2ae0a7199534dc5d959ee
SSDEEP 3072:Xbnfw8lZ96mRDaUR28oV7OY+7S0bif90DG:A
TLSH
T193C3C0A55BF81018F2B77F3CAAF640529E6ABE66AE31D41D0190118F05B3F12DCB573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 710KB
SHA256 3053aa67e9cb37cd6f9645ef3bec8d43b1863afd852d3860ea73fcd83c7010c3
MD5 82d7f8765db25b313ecf436572dbe840
SHA1 da9ed48d5386a1133f878b3e00988cbf4cdebab8
SHA512 59766b408b548dc020b54c79a426b361112c33c7263c16ca2e69485dadca05fb4c63b6433063e77c6a9e28a43ec6d3c8206ea702a33b79151fa6309d83b316a8
SSDEEP 3072:MhpwBxTEsmVdx1wN8EBNjcbg+hSILPDtzcSx2A8q1JuqaB32rSrSQYCxly/2dj9K:zqv1N
TLSH
T11CF4956153EA8618F2F77F64AEB812A46E66BCE6BD79D64D1250109D0CB1F40CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 683KB
SHA256 318ddf14845758c9eb20d8a5b77b1ed2d0741d1ecee3d29fc403e5bb9dfec80e
MD5 3a681d0069917d0cb9b335fbe120c7e5
SHA1 563f018111992add15aa8052b3727adeaca682f5
SHA512 48115ebfe5654b288712a49379b2f805c3337ba3b40a749fd94e7bad6fce20f61a50ac2c4b56ae97729198713d2fa5f14e2287e8d232862d2995efd1866038fc
SSDEEP 3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRu:78M6d0w+WB6z
TLSH
T19EE4699167FD4208F2F73F64A9B516A45E7ABCA6FD79C25C1250009E4AB2E50CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 767KB
SHA256 ce2730d1190dddd8228631f95f4409cb24c85566515894f9ff17817c5e9a5268
MD5 53719832df039b016f092254ed3b1184
SHA1 71306ce2d2903562bdd3e43ff89392c85fa1a172
SHA512 025e74b40ae0ce0a3c844f3bce1fa4edb2a1d88bd080d044447075379ca563cb13bb9d50f67dfb4842acebb5bf3906d801e6dcd5ec74ef4e8581ea0bb72d59b8
SSDEEP 3072:o2xx7F17Fetjvtx1tT3JCF86nceg1nE643GYBncOvuldhEtZ1d813KXKUBUcwg5/:+tjvtx1tT5Snyn6vuxZDFwq+
TLSH
T166F4FE5067F95209F6F77F29A9B91A654E7ABD96EC39C11C0220019E0EB1F84CDB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 771KB
SHA256 8809b6a90e727f0d19deb1a4ecdb422e26c95c7ea1f6ca8c3f8ef4aa7623f1c4
MD5 df02faabbd30f4232d8c03a29ede3a85
SHA1 86e710208025ff6c613d80d66651d20031cad9a9
SHA512 d2d7527016cb510d69e0ae2d6df9c1ca96a5565558d7aa5a068901174a0b45b447d2401516bc58d9c7d4fa49e84820318898c0e18fffed1bbb73aa3bdc30390e
SSDEEP 3072:8seo6JpGytgViPIny4auTsQy2XQDIefsnnSRfERwpZRVDNtflhz4FV643NB+/dvo:gTGQcyygID
TLSH
T144F42E60A7F95209F6F73F64A9B915654E6B7DA6EC39C21C0250009E1DB2F84CDB8B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 760KB
SHA256 8c6e21b2b771fe73c56d375e2ac9de840987ff53bcac6711e10f18e8fb8f25de
MD5 95bdc0e259dc38a03a63efac8397e926
SHA1 0cf5a19ba6d36e8a6f0520a38a03d8bfa4a6959a
SHA512 30d9eb7b3fde78b9e3481379780fdce8219a29b906d2cb3d09d2625f48221ef1dd75186bc7ffd6abe9262576077e65d09897ba0a5fc27e1fcb8a487766bbbabd
SSDEEP 3072:g+8gxXowjkUXx5E8d8tj/v9GLcr+cu8ov+pmPxw643SBYwTaa2BydhOK06J1d9Mf:rYj/v9GLBLaa2Bx6Z2Bbz
TLSH
T1C0F44462A7FD5608F6F77F64A97816654E7BBE96AC39D21C0260009E0972F54CCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 475KB
SHA256 6b691a8f98a10e8ec474a80beefdac6b63d3b036e1c181e6be80993477058c56
MD5 1abef13389c5a97b099ac917ed3ed4fb
SHA1 e7c2bceef4d3dad7aeb2e81aeceaf6822451fd9e
SHA512 803e8208950eb8f79cb1d50e93f4851f1f8452810dd2b7030ffa7fda388096466b7c43a837f9a33c1581e2ef9d2efc712a793bf3ae638e9bd5a88238e9fd8112
SSDEEP 3072:ZZg3ID5H7gVmRw4T0O643IBh5oUdhlFStjdC1dpylObLb3tLbsBU+wgyXzdW9nmQ:Tg33mRwZYpm/7g44
TLSH
T165A4978427EC460CF2F77F64A9B520A02E6EFD65AD7AC56C1550408F0972E49CEB4B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
TLSH
T17561011D8E8A416EDA7E36A95C2C192419B5FE770AC058EF317DBCDF0D4A80A24D352F
MD5 SHA1 SHA512 TLSH

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 29KB
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
TLSH
T1F3D2201267F94158F2F66F98AAF594775A73BEE66D38D1AC01A0031E09E1E40CDB13B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4232-0-0x0000011C75DF0000-0x0000011C75E12000-memory.dmp

Download