799502ee36b7dd851a3843083ba16b4b2f45a45a7684185d0d733a636e734662

Analysis

max time kernel
298s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
حل مشاكل/حل مشكله شاشه CRU.bat
Size 1KB
Sample260824-p5dnhsde33
SHA256 799502ee36b7dd851a3843083ba16b4b2f45a45a7684185d0d733a636e734662
MD5 7997c1826abdbe73ea16118259e71551
SHA1 32f184a63defab57adc7df05e3da44131aabc6cf
SHA512 0fdc01efa39194691146d98b2f93b973d4a9f646fe6d2359e3ba83692a94964a460a4fea37f26eadc9a2dbd21280f7876a7b516bf291dc6457dcc7877f8f55a3
TLSH
T1F041F1233E517D9C0682C647DAA46703FE7D1C8B10835EC5B8E242B06E62F94A27CB8D
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4492	powershell.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfTMP.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3332	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
624	cmd.exe
6116	cmd.exe
1968	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4492	powershell.exe
4492	powershell.exe
3332	powershell.exe
3332	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeIncreaseQuotaPrivilege	3332	powershell.exe
Token: SeSecurityPrivilege	3332	powershell.exe
Token: SeTakeOwnershipPrivilege	3332	powershell.exe
Token: SeLoadDriverPrivilege	3332	powershell.exe
Token: SeSystemProfilePrivilege	3332	powershell.exe
Token: SeSystemtimePrivilege	3332	powershell.exe
Token: SeProfSingleProcessPrivilege	3332	powershell.exe
Token: SeIncBasePriorityPrivilege	3332	powershell.exe
Token: SeCreatePagefilePrivilege	3332	powershell.exe
Token: SeBackupPrivilege	3332	powershell.exe
Token: SeRestorePrivilege	3332	powershell.exe
Token: SeShutdownPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeSystemEnvironmentPrivilege	3332	powershell.exe
Token: SeRemoteShutdownPrivilege	3332	powershell.exe
Token: SeUndockPrivilege	3332	powershell.exe
Token: SeManageVolumePrivilege	3332	powershell.exe
Token: 33	3332	powershell.exe
Token: 34	3332	powershell.exe
Token: 35	3332	powershell.exe
Token: 36	3332	powershell.exe
Token: SeIncreaseQuotaPrivilege	3332	powershell.exe
Token: SeSecurityPrivilege	3332	powershell.exe
Token: SeTakeOwnershipPrivilege	3332	powershell.exe
Token: SeLoadDriverPrivilege	3332	powershell.exe
Token: SeSystemProfilePrivilege	3332	powershell.exe
Token: SeSystemtimePrivilege	3332	powershell.exe
Token: SeProfSingleProcessPrivilege	3332	powershell.exe
Token: SeIncBasePriorityPrivilege	3332	powershell.exe
Token: SeCreatePagefilePrivilege	3332	powershell.exe
Token: SeBackupPrivilege	3332	powershell.exe
Token: SeRestorePrivilege	3332	powershell.exe
Token: SeShutdownPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeSystemEnvironmentPrivilege	3332	powershell.exe
Token: SeRemoteShutdownPrivilege	3332	powershell.exe
Token: SeUndockPrivilege	3332	powershell.exe
Token: SeManageVolumePrivilege	3332	powershell.exe
Token: 33	3332	powershell.exe
Token: 34	3332	powershell.exe
Token: 35	3332	powershell.exe
Token: 36	3332	powershell.exe
Token: SeIncreaseQuotaPrivilege	3332	powershell.exe
Token: SeSecurityPrivilege	3332	powershell.exe
Token: SeTakeOwnershipPrivilege	3332	powershell.exe
Token: SeLoadDriverPrivilege	3332	powershell.exe
Token: SeSystemProfilePrivilege	3332	powershell.exe
Token: SeSystemtimePrivilege	3332	powershell.exe
Token: SeProfSingleProcessPrivilege	3332	powershell.exe
Token: SeIncBasePriorityPrivilege	3332	powershell.exe
Token: SeCreatePagefilePrivilege	3332	powershell.exe
Token: SeBackupPrivilege	3332	powershell.exe
Token: SeRestorePrivilege	3332	powershell.exe
Token: SeShutdownPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeSystemEnvironmentPrivilege	3332	powershell.exe
Token: SeRemoteShutdownPrivilege	3332	powershell.exe
Token: SeUndockPrivilege	3332	powershell.exe
Token: SeManageVolumePrivilege	3332	powershell.exe
Token: 33	3332	powershell.exe
Token: 34	3332	powershell.exe
Token: 35	3332	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2736	1968	cmd.exe	91
PID 2736 wrote to memory of 704	2736	net.exe	92
PID 1968 wrote to memory of 624	1968	cmd.exe	93
PID 624 wrote to memory of 1132	624	cmd.exe	94
PID 624 wrote to memory of 4820	624	cmd.exe	95
PID 1968 wrote to memory of 2156	1968	cmd.exe	96
PID 1968 wrote to memory of 2848	1968	cmd.exe	97
PID 1968 wrote to memory of 2068	1968	cmd.exe	98
PID 1968 wrote to memory of 4988	1968	cmd.exe	99
PID 1968 wrote to memory of 2920	1968	cmd.exe	100
PID 1968 wrote to memory of 436	1968	cmd.exe	101
PID 1968 wrote to memory of 4192	1968	cmd.exe	102
PID 1968 wrote to memory of 5792	1968	cmd.exe	103
PID 1968 wrote to memory of 4080	1968	cmd.exe	104
PID 1968 wrote to memory of 304	1968	cmd.exe	105
PID 1968 wrote to memory of 4500	1968	cmd.exe	106
PID 1968 wrote to memory of 1248	1968	cmd.exe	107
PID 1968 wrote to memory of 4684	1968	cmd.exe	108
PID 1968 wrote to memory of 1244	1968	cmd.exe	109
PID 1968 wrote to memory of 5732	1968	cmd.exe	110
PID 1968 wrote to memory of 3680	1968	cmd.exe	111
PID 1968 wrote to memory of 3440	1968	cmd.exe	112
PID 1968 wrote to memory of 5020	1968	cmd.exe	113
PID 1968 wrote to memory of 3508	1968	cmd.exe	114
PID 1968 wrote to memory of 360	1968	cmd.exe	115
PID 1968 wrote to memory of 6116	1968	cmd.exe	116
PID 6116 wrote to memory of 5268	6116	cmd.exe	117
PID 6116 wrote to memory of 4484	6116	cmd.exe	118
PID 1968 wrote to memory of 4492	1968	cmd.exe	119
PID 1968 wrote to memory of 3332	1968	cmd.exe	120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\حل مشاكل\حل مشكله شاشه CRU.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" | findstr /i "00"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}"
    3⤵
    PID:1132
- - C:\Windows\system32\findstr.exe
    findstr /i "00"
    3⤵
    PID:4820
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\EDID_OVERRIDE" /f
  2⤵
  PID:2156
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "NV_ModeList" /f
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "CustomModes" /f
  2⤵
  PID:2068
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /v "FreeSyncMinHz" /f
  2⤵
  PID:2920
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000\EDID_OVERRIDE" /f
  2⤵
  PID:436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "NV_ModeList" /f
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "CustomModes" /f
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "FreeSyncMinHz" /f
  2⤵
  PID:304
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\EDID_OVERRIDE" /f
  2⤵
  PID:4500
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "NV_ModeList" /f
  2⤵
  PID:1248
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "CustomModes" /f
  2⤵
  PID:4684
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:1244
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration" /v "FreeSyncMinHz" /f
  2⤵
  PID:5732
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties\EDID_OVERRIDE" /f
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "NV_ModeList" /f
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "CustomModes" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "DALRule_UserDefinedModes" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Properties" /v "FreeSyncMinHz" /f
  2⤵
  PID:360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" /s | findstr /i "EDID_OVERRIDE"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" /s
    3⤵
    PID:5268
- - C:\Windows\system32\findstr.exe
    findstr /i "EDID_OVERRIDE"
    3⤵
    PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Set-DisplayResolution -Width 1920 -Height 1080 -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Get-PnpDevice -Class Display -ErrorAction SilentlyContinue | ForEach-Object { Disable-PnpDevice -InstanceId $_.InstanceId -Confirm:$false -ErrorAction SilentlyContinue; Enable-PnpDevice -InstanceId $_.InstanceId -Confirm:$false -ErrorAction SilentlyContinue }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004CC
1⤵
PID:6128

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20260824-1354.dmp
1⤵
PID:944

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 50e2e271ec4d407b2620968fde5d775d879404bca6032c11ee574d2d4cc3ea94
MD5 21cfaefe29ddeccc1010078c9440577b
SHA1 340fede54f95b170f3bc7a023691310f94f73c79
SHA512 7188c3b058b77de39cfe077b65cb94c4cfb66b626f357a03bc0f56cea34e057ce81cc02c3f214efa315658430e0513428b0e63cc889ed146c6820db566211864
TLSH
T187215C33F3DC8614DC9A413A10CEEC1136B6C7D7409ECEAB7B84D544B42F299DE60560
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ef4jtkuw.nt1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ef4jtkuw.nt1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 154KB
SHA256 2d21b2544ee0f19b3fc76dcef44efd15d75535117bfe6cc9a437dfa6a7f38a2e
MD5 7571ac27833618565fc1b17af1f335b1
SHA1 a3d23c3ac0f998006b1c05745ee5abae9b421cac
SHA512 70a76b6c1f6faf8db7a1c1a16e9423c65e60ff818370e2e48aa236c5524b51cdf01e9eef760c2f015f20ff69cc71eb8e833f91ffc2a898dc5bb7225c0e970d2c
SSDEEP 3072:wb+j2tTPhtqgG+Hf5Rz5YjO3QzTTCoigI1WZz40NI0brFKnH2M7Pqs0egeS:2oigII
TLSH
T128F304500BE9051DF2F7AF38AAF65042AE6AFDA6BE31D81D1150128E0572E11DC79B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc009.dat

Path C:\Windows\System32\perfc009.dat
Size 131KB
SHA256 63cc5dee207f7a2ad7e0ce1481e94eba46605534db16ad33da4fc61417235265
MD5 a02cb7687ef092f9248898930c20d35d
SHA1 1800951f108214a878c3244425ca97c0d183160b
SHA512 4cdb00132cf59036dabc1fd65483ff60f5af34f087ebdddc98da1b8feaa8a69a01b213783e7d30c7ff6d2096661f3707983002b395398f06ada7b1d30668a49a
SSDEEP 3072:Xdd4jjO8PzT3hoKgIOWIr40lW0v2RjSsp237/q8cKV7Y:koKgIz
TLSH
T1AED3BEA55BF81018F2F77F3CAAF650529E2ABD66AE31C41D01A0124F0572E12DDB973E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 160KB
SHA256 3c29f5c8d53ddbe70904a77242a381d0f23c3959b2bb63716aa0cc26f9ddb41c
MD5 5d4565ddf8334e6e1d2f2b58d4bc8b77
SHA1 4d7285ea58fbc63f68febf307d82bb43e09a2454
SHA512 73a2e433e3a5e539d4e9bdd923c1ce7b73aa0595543ee9e92ea21b7fe1bbaf71adc9b61fe43cbd64995119904c677f74e9162cd88372d905d2fe4a0f80e441db
SSDEEP 3072:XL7SjORMzTdGoZgIpWhI40uK0uMb217wqtT3qk8:poZgIE
TLSH
T1E7F377505AF80216F2F3BF38AAFA55165E3ABD56AD36C42D0160124E0DB2F11DC78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 154KB
SHA256 837321e62eb33a423a247237742e3bfda181e250fcabb3c686e5e0992a5ee920
MD5 27496f5e05b90441df9222732ebbe81c
SHA1 2947f5af8496bde963fa2ede5313dd4c4b560cd8
SHA512 343afb119a6e14eeb83ecf4db42beefdb8e829bdd04d2344c5aa1cead1040db29ac24331e60c83de0f07cb36eb305e5c16951dae9351ab23be09743592a37189
SSDEEP 3072:/kDtTckjO6QzTU1okgIaW3V40vH0YkbB2U75q4bXfhm:/KokgIJ
TLSH
T17CF39A945BF90115F2F7BF38A9FA11029E6ABD5BAD32C41D0191018E48B2F51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 144KB
SHA256 0f5f838113b2bbf023c71561b39380cd40a1881d24c96da7d4152ea82d947900
MD5 2350f01595ba09fd16eedc1d19adb905
SHA1 f9397132272fa9c4d57f0949aef5b52166562663
SHA512 26159fc5962e02e886c49be7a58a5a8360856b1fdc432a96c443acf7c5a36ebc7312a30b183f7ca3de61a999ae463247af68649d5b3c2bf3edcbfe6b4549da1e
SSDEEP 3072:0A67APdGk9jOpFzTbZo9gIEW0c40ve0yvz2O7YqOj9lXF:uo9gIF
TLSH
T135E3AAA16BF81108F2F77F38A9B951125E3EBE66AD35C42D01A1018F0972E51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 726KB
SHA256 8c406001c8f53f5886969775f7178c1cef2d2cdec664f8a3d04c050ef837a6cd
MD5 a2ff838b0f9a74c47bd2eaca6dfd7b56
SHA1 3eb30dd75685c023c8ef6d9cb99dc5aee24ff406
SHA512 65799eef0af87ff7e866b2a39f3c435ddb93aa17987abd467c306fc082516f19f55510d94f64291f09a1d4b194ab5d106e756390aee54c38b4524576e1463d60
SSDEEP 3072:MfpwBxTEsmVUwN8EBNjcbWhSILPDtzcSx2A8q1JuqaBYrSrSQYCxlFdj9J2hSF1V:rZzzORs1JX
TLSH
T104F4C86153EA8618F2F77F64AEB812A46E62BCE2BD79D60D1250109E0C71F40CDB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 688KB
SHA256 3bab5967d2ac8b0f8ddc0b210694d7172b20213c19b2d3588059c893cfd1d592
MD5 0793133d828b3d3b22fb5ddafaabf4b4
SHA1 c3e2eb8cfec42e3c9e7def52a498a336e45210b8
SHA512 10d961928116af0b96650607fa1c6d93c53ac4371fd66ac3970736f0cc5fc1a2872dc2a455a51d0787c0ebbaaa42a7e8924a2026a95e45f66437f56dd8e2a5f3
SSDEEP 3072:ZUqGrdowz4j0PrRZnpETMsZ8M6d0PHCWsnxJfVF6shlOE3XcGBloOZs1GoYOdGo8:f8M6d06WsnyOZs13e
TLSH
T116E4799167FD4608F2F73F64A9B916A45E7ABCA6FC79C25C1250005E4AB2E50CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 769KB
SHA256 879e1268b9de3e0ddf9bfe4c3115c57b5ae6149f1ef1b1a3131c0d66ae125b8b
MD5 d1f123662a9be30633e79ff172e80f60
SHA1 fe5904c5f2ad1f37bfee356e403ee410e77e21c5
SHA512 caab875e9ac8fdd183d5962f5e8a312386d92c1a69517000d140e703088bee395a90f4bb25f969d12093defffc46415fde32ef986f29f154da8656d88851b704
SSDEEP 3072:F2Gx7F17Fetjvt2JYH8QncegungPlZaJQ8E9F6sWOE37wrBuO7s1pYOmqOpatjaK:otjvtuMnpngPlZavzO7s1pYOm45Z
TLSH
T152F40F5067F9560AF6F77F19A9B91A654E7ABD92EC39C11C0220019E0EB1F84CD78B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 770KB
SHA256 68cd2620bd7be883a883a800255e6afa5a63d94732db0b11616b867007538365
MD5 3faf6a679b49ecca2c747ad22413f572
SHA1 89005ef75ca38cd0ec2e292bc5619d04c4fb13fe
SHA512 d152b82d59610a921d2b976264ace4412c72626e5edda6116c2790deb3d2d986e7d07d30ee9199beec97fdebb3f14e5c6e0b8e6f594be6d151c5d57426184f83
SSDEEP 3072:8eeo6JpGytgOiPIny4auTsQO2I70IeMsCnSRwERwpZR9DNtflhzxxjAgiblQH4cY:meH1AgkSBORs10B9Jb
TLSH
T1BBF42E60A7FA5209F6F73F64A8B915654E6B7D96EC39C21C0250009E1DB2F94CDB8B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 744KB
SHA256 679d96bc257f43b36fa7c89c91f4bd0eccefc60efeab6689ee1d4833e6fb078c
MD5 4566575408d4bfcb2ee4df8f3f92499e
SHA1 cf90b96e0a49cdb2c284c75157ea4111b7d4e41a
SHA512 b439f9800db8900110258b8a962e4cfab12d6df056ad7823e6c4b2c483ee5dbe377df5dcd9abbd32f06f4c66d935324e0ac91411000f8a873241be8ca2ffe88a
SSDEEP 3072:g48gxoowjkUXxL8d8Zj/v9GLcr+c98ov+pmPxHHtZVbRKI3F6sOOE3/BROMs1VxS:FCj/v9GLcnHtknOMs1Vx0fJunDV3Z+
TLSH
T1A5F44362A7FD5608F6F77F54A97916654E3ABE96AC39C22C0260009E0D72F54CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 448KB
SHA256 0577bcea9238cb73bce83b64d66672a98c6838489ab87a9299e45e04fb2222de
MD5 fca9f0c19a5544c6a69ed8524169fa46
SHA1 edff2ba75565628e26df2baebcf96c01d72e9aae
SHA512 d7cabd367f1156515c37c883f8e248833ebccfd26127ed95d1c26535f5b12e3e9f996d179b70637993211775986cf7319d4b090cc16929e5a1860460a7cfb851
SSDEEP 3072:6ZS3MD1H7gVmRwNT01ZmX0RZKFZwF6s9OE3LB2/7SsxOOs1TzOh7tjLy0lfPJ/w5:kS3jmRwuc0RZYOOs1Tkuj
TLSH
T127A4B78836E8060DF2F77F64A5B520A02E6EFD65ADBAC56C1550408F0971E48CEB5B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
TLSH
T17561011D8E8A416EDA7E36A95C2C192419B5FE770AC058EF317DBCDF0D4A80A24D352F
MD5 SHA1 SHA512 TLSH

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 29KB
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
TLSH
T1F3D2201267F94158F2F66F98AAF594775A73BEE66D38D1AC01A0031E09E1E40CDB13B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4492-2-0x000002CFEAB10000-0x000002CFEAB32000-memory.dmp

Download

memory/4492-13-0x000002CFEB110000-0x000002CFEB11A000-memory.dmp

Download

memory/4492-12-0x000002CFEB100000-0x000002CFEB106000-memory.dmp

Download

memory/4492-11-0x000002CFEAFD0000-0x000002CFEAFD8000-memory.dmp

Download

memory/4492-10-0x000002CFEB120000-0x000002CFEB13C000-memory.dmp

Download

memory/4492-9-0x000002CFEAFC0000-0x000002CFEAFCA000-memory.dmp

Download

memory/4492-8-0x000002CFEAFE0000-0x000002CFEAFFE000-memory.dmp

Download

memory/4492-7-0x000002CFEAE60000-0x000002CFEAE6A000-memory.dmp

Download

memory/4492-6-0x000002CFEADA0000-0x000002CFEAE52000-memory.dmp

Download

memory/4492-5-0x000002CFEAD80000-0x000002CFEAD9E000-memory.dmp

Download