a29ebefb55f2f347bc2579146c3ebbf047a23ff75fc6fe2983f20aed6d76329e

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TweakUtility.bat
Size 13KB
Sample260930-c3cl8awsds
SHA256 a29ebefb55f2f347bc2579146c3ebbf047a23ff75fc6fe2983f20aed6d76329e
MD5 aea10c5066eecf6a30d7e16307d8b899
SHA1 0bac2ad6ee74612f1044662a2d30579b4cecb778
SHA512 fa1736b430ff61ad1f723f36a61ea49a2fe23d1a9f546f83a70a7b866e67dfbdeab43464d198c7f0fa3f56cd7e20d1951a917137d5ac57f9355759ae4e486ae6
SSDEEP 384:2HW1LwGVnZy1xkL0GfExP/frbb0Ufw7NgvU:Pc1vDvU
TLSH
T14F5282132C2503F78976F762B7A58292F3A9C5C30630AEDE3197B035B24B385467F999
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4948	powershell.exe
1696	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
4992	bcdedit.exe
2632	bcdedit.exe
540	bcdedit.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4284	cmd.exe
4372	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1696	powershell.exe
1696	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeBackupPrivilege	3564	vssvc.exe
Token: SeRestorePrivilege	3564	vssvc.exe
Token: SeAuditPrivilege	3564	vssvc.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeBackupPrivilege	4992	bcdedit.exe
Token: SeRestorePrivilege	4992	bcdedit.exe
Token: SeRestorePrivilege	4992	bcdedit.exe
Token: SeRestorePrivilege	4992	bcdedit.exe
Token: SeBackupPrivilege	3644	srtasks.exe
Token: SeRestorePrivilege	3644	srtasks.exe
Token: SeSecurityPrivilege	3644	srtasks.exe
Token: SeTakeOwnershipPrivilege	3644	srtasks.exe
Token: SeBackupPrivilege	3644	srtasks.exe
Token: SeRestorePrivilege	3644	srtasks.exe
Token: SeSecurityPrivilege	3644	srtasks.exe
Token: SeTakeOwnershipPrivilege	3644	srtasks.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4868	4372	cmd.exe	86
PID 4868 wrote to memory of 2156	4868	net.exe	87
PID 4372 wrote to memory of 1112	4372	cmd.exe	88
PID 4372 wrote to memory of 2396	4372	cmd.exe	102
PID 4372 wrote to memory of 1696	4372	cmd.exe	103
PID 4372 wrote to memory of 3080	4372	cmd.exe	112
PID 4372 wrote to memory of 4284	4372	cmd.exe	113
PID 4284 wrote to memory of 4948	4284	cmd.exe	114
PID 4372 wrote to memory of 3996	4372	cmd.exe	115
PID 4372 wrote to memory of 4572	4372	cmd.exe	116
PID 4372 wrote to memory of 4896	4372	cmd.exe	117
PID 4372 wrote to memory of 892	4372	cmd.exe	118
PID 4372 wrote to memory of 2824	4372	cmd.exe	119
PID 4372 wrote to memory of 2072	4372	cmd.exe	120
PID 4372 wrote to memory of 1416	4372	cmd.exe	121
PID 4372 wrote to memory of 1688	4372	cmd.exe	122
PID 4372 wrote to memory of 2952	4372	cmd.exe	123
PID 4372 wrote to memory of 4404	4372	cmd.exe	124
PID 4372 wrote to memory of 4268	4372	cmd.exe	125
PID 4372 wrote to memory of 1672	4372	cmd.exe	126
PID 4372 wrote to memory of 3932	4372	cmd.exe	127
PID 4372 wrote to memory of 4644	4372	cmd.exe	128
PID 4372 wrote to memory of 4652	4372	cmd.exe	129
PID 4372 wrote to memory of 3000	4372	cmd.exe	130
PID 4372 wrote to memory of 2704	4372	cmd.exe	131
PID 4372 wrote to memory of 4992	4372	cmd.exe	132
PID 4372 wrote to memory of 2632	4372	cmd.exe	133
PID 4372 wrote to memory of 540	4372	cmd.exe	134
PID 4372 wrote to memory of 4876	4372	cmd.exe	135
PID 4372 wrote to memory of 1616	4372	cmd.exe	136
PID 4372 wrote to memory of 4780	4372	cmd.exe	137
PID 4372 wrote to memory of 2548	4372	cmd.exe	138
PID 4372 wrote to memory of 720	4372	cmd.exe	139
PID 4372 wrote to memory of 4980	4372	cmd.exe	140
PID 4372 wrote to memory of 2556	4372	cmd.exe	141
PID 4372 wrote to memory of 4768	4372	cmd.exe	142
PID 4372 wrote to memory of 4948	4372	cmd.exe	143
PID 4372 wrote to memory of 4272	4372	cmd.exe	144
PID 4372 wrote to memory of 916	4372	cmd.exe	145
PID 4372 wrote to memory of 4572	4372	cmd.exe	146
PID 4372 wrote to memory of 2108	4372	cmd.exe	147
PID 4372 wrote to memory of 3284	4372	cmd.exe	148

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TweakUtility.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2156
- C:\Windows\system32\choice.exe
  choice /c 123450 /n /m "Select an option: "
  2⤵
  PID:1112
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "try { Enable-ComputerRestore -Drive 'C:\' -ErrorAction Stop; Checkpoint-Computer -Description 'TweakUtility' -RestorePointType MODIFY_SETTINGS -ErrorAction Stop; exit 0 } catch { Write-Host $_.Exception.Message; exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /f
  2⤵
  PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "Get-Date -Format yyyyMMdd_HHmmss"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Date -Format yyyyMMdd_HHmmss"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key1.reg" /y
  2⤵
  PID:3996
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key2.reg" /y
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key3.reg" /y
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg export "HKCU\System\GameConfigStore" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key4.reg" /y
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key5.reg" /y
  2⤵
  PID:2824
- C:\Windows\system32\reg.exe
  reg export "HKCU\Software\Microsoft\GameBar" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key6.reg" /y
  2⤵
  PID:2072
- C:\Windows\system32\reg.exe
  reg export "HKCU\Control Panel\Mouse" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key7.reg" /y
  2⤵
  PID:1416
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key8.reg" /y
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key9.reg" /y
  2⤵
  PID:2952
- C:\Windows\system32\reg.exe
  reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key10.reg" /y
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Policies\Microsoft\AppV\CEIP" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key11.reg" /y
  2⤵
  PID:4268
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key12.reg" /y
  2⤵
  PID:1672
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key13.reg" /y
  2⤵
  PID:3932
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key14.reg" /y
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key15.reg" /y
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key16.reg" /y
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Services\SysMain" "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\key17.reg" /y
  2⤵
  PID:2704
- C:\Windows\system32\bcdedit.exe
  bcdedit /export "C:\Users\Admin\AppData\Local\Temp\backup\20260930_033615\bcd.bak"
  2⤵
  - Modifies boot configuration data using bcdedit
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2632
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue useplatformtick
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:540
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "GlobalTimerResolutionRequests" /t REG_DWORD /d "1" /f
  2⤵
  PID:4876
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation" /t REG_DWORD /d "42" /f
  2⤵
  PID:1616
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority" /t REG_DWORD /d "8" /f
  2⤵
  PID:4780
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Priority" /t REG_DWORD /d "6" /f
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d "High" /f
  2⤵
  PID:720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "SFIO Priority" /t REG_SZ /d "High" /f
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only" /t REG_SZ /d "False" /f
  2⤵
  PID:2556
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Affinity" /t REG_DWORD /d "0" /f
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Clock Rate" /t REG_DWORD /d "10000" /f
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v "AllowGameDVR" /t REG_DWORD /d "0" /f
  2⤵
  PID:916
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\GameBar" /v "UseNexusForGameBarEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f
  2⤵
  PID:2108
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f
  2⤵
  PID:3284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0b4beed95f9efb8c319a6654f9e2e9fd9bf63760c8d6c12f00ca80a22b459998
MD5 6e54407afd197613d1a52b611732c0d6
SHA1 f8f078d2e919f8d7aa4beb5b2bd1ca5aea200df2
SHA512 3ab37a2d76d61e7be4a21cc58c1a00d33be1f75a8aac8a2ffd875d2c866cd71fb87a6c0e5145e68ac4a57051f8c2bf5d77660270d9044003394445d72b605d82
TLSH
T1A811B633F38C8A21CC96163A408D9C2072B283C7819EDFAF7BC0C215A5BF588CB31280
MD5 SHA1 SHA512 TLSH

Submit Download

REG2793.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2793.tmp
Size 2KB
SHA256 baf933f67edba9f640d36d33be6b7fbbd068a9e129f9002772baf51d64baf32c
MD5 d89b3d3cb58978d109cfb1ab90866910
SHA1 8ad3dd660c9f46cbd78110d3caf0ae078267549a
SHA512 18de75578f25ed894707daab147b3ddefed21560b46d3274e8ca8ce97487fa377c1b7a957175ba4fba51147b8f9d5d2a37be7af272e1e1887b3747ed1cb2ac36
TLSH
T1EC415177E7A62049A3B14E68DFE74463F6767816392DC48904C22B4D44D2A44A4F13BF
MD5 SHA1 SHA512 TLSH

Submit Download

REG27E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG27E1.tmp
Size 390B
SHA256 fc3ddefb3d41b3e8ef54586ad52245e1475605a567dc6815df9bc5a50aee01f3
MD5 7e22b477c82ddec6ddc1f3c7f0bac56a
SHA1 2d91fd7be63226f00f3e6baae19b85603158f90f
SHA512 5b746f766e254eecfa548b65b74680f2a7ce8d94d09b2c77e02d6357875b9b98ed9810caff1188c55f66d1d28530a6d4f566a74071e0ce56be87a75ffe874fe1
TLSH
T17DE04F0357F62404F6F21BD5ADFE98674736BDA41958C4ED11D4038E85F0B0450113B7
MD5 SHA1 SHA512 TLSH

Submit Download

REG282F.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG282F.tmp
Size 692B
SHA256 37155b8ecf9ba7faf73f6a71c00cca3885875680c090b162f39191c621c8c3b4
MD5 2daa552e38fb5cf777d17011f9d7bd76
SHA1 532653b3048d0561eb70746a980ddfd8427b6acd
SHA512 ed567c0c10b60bbd973a313d75b41fc8c090eb223956a604f4af429bb7a42337e6f3aa30bb70ffa181cf50fbb38fec324f09fec8828b579a94c4bd5aa84e7809
TLSH
T15501AF0347FA2009F2F35A94C9E598775773BA252E3AC0AE20C04F0E89F0A4084613E7
MD5 SHA1 SHA512 TLSH

Submit Download

REG286E.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG286E.tmp
Size 295KB
SHA256 2e6b40cf938bab37c7cd769616aaa2d4e63b46fe4b3a4b5d2341dc0396b947f0
MD5 2114795799095f7fc121c725459288e7
SHA1 6b21fc49fd040236939dc462f82dcb76dcdc3e5f
SHA512 8ed408b51b9f882645aba6d7e625eacc4c25f531ef5beab77abd6754ef6a05cd99df89d8e908874600d31bccccd4da6eba40d9ad9bcad02db049723444dd276d
SSDEEP 1536:+9w/qBoltRZOzC227j6pCH4XalFejo5jWJ+N7u:+9Kqe5MC22CpNXavejW6
TLSH
T11A54203ACFF5142691738D69CEF741E7FA5A3807322CDC4E54C227460D93B4A68A276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REG2939.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2939.tmp
Size 182B
SHA256 04343abb18556c58b06c7d195dd3f1f97c07e4d1ab7628ae115719ffdd4ca01c
MD5 49b5c2dd97c314c4dafb9b2596f17cfc
SHA1 473f7710765c986346c7962346811bc7de17af77
SHA512 5b618c8e6fc98ca272276fa7a87edf367f97ef60915776e3b93f22c894021446dcde53ab33ac8916c401c2c55fa2f3e24e22b1ef9a5d9fb09ed7f3a649b00fc3
TLSH
T109C0129213E0840AF2F71EC18AE9E8B8AB3264950928E8EA1198410B84F592084203BB
MD5 SHA1 SHA512 TLSH

Submit Download

REG2977.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2977.tmp
Size 1KB
SHA256 0e9983c2a09c1f6aaa09bf7d471395df5780068352fda0d2f7d5dd92b03acb1c
MD5 45cdd47af8d94b8bc3c689c0b4bad598
SHA1 84ee179651ee41644e54dec968224e9ebe9a2fe6
SHA512 f511c6bd03e0124d4a4caea274e109de70f34670dfa9ed0cb67c909abc3e20f87d2e5d0cb0f221789db852bfb2d06b68301cd28df334cf537bcdc588f0b1b15e
TLSH
T14B314A43E7F82045E2F64E94EEF158731B377CC62A5ED04E29C11F0E19E1A048422BEB
MD5 SHA1 SHA512 TLSH

Submit Download

REG29B6.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG29B6.tmp
Size 6KB
SHA256 989fbdcb3810eb0314e0753f6022d9b5d6cdb8a1e06997dd289ea8b2f2574b9c
MD5 2fb352f9c91a42de98b8814b49ee84aa
SHA1 7442ebd053135bff2f51131ad3d1e1b59d38861e
SHA512 3d9e73573b4f6b7d247ad5b79aec3f9451775b18b97b599d1c41b439f7a755b593975977df0c9faae77ffc95dced6856b3f721f0ea325dcf7633198b61ddce11
SSDEEP 24:QChVTepcY/dsHYzpuEkWQG/IR3eR42RRlqxSJGY1vEkWQGKIRXR4tRRNYUqImWvm:tKpcY/d7JYG1yyGYMYGyTXmm7DBwIzG
TLSH
T19CD18616C7B6294AA2738F4DDEE750775BA67D46263DC8CB98C03B0A0AD3A0D24113DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REG2A14.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2A14.tmp
Size 294B
SHA256 a9571ea1d35668a81a9ae0b59596084b2801e44f4747eb3d28df421f9bdc8986
MD5 87cea6cb43aa3a2c440e787ba8ada490
SHA1 9bcb8c5e42ac9616b66c9344b7d6f5232b7026ec
SHA512 36b00a4db81cd8295aedc81e3bd2e74eb0105d2474c004f720f19f3794611b5f13fb8a0050fe2720b8670b89b5e9f792c2fcad34280bf303fb7ab8584aa0bb94
TLSH
T1EFE017121BF12109F2F31E859AE5A9234F3299982D29C8DD12C4834A89F0A64D8303BB
MD5 SHA1 SHA512 TLSH

Submit Download

REG2A81.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2A81.tmp
Size 4KB
SHA256 80202d7ec40d7ed02df414d96370d4010ae134710f858b1bd17780366ea49bcd
MD5 1dc07d17d2712f4dd70d8f19ab709a01
SHA1 ec53f3e4d7182f0b0a3431f86587d6f8157aea58
SHA512 a39c377d6d14176b8516d78653833e66b999105845e784317ab3bc6f647467cc1ed5361fc71afd2659c09d46f87a20fd45eb7a1504327461834ced887608f35c
SSDEEP 48:tnQeNcFR6P/c3L5rAs274DcFRjckQeaQefv3LwrQeyyQey71zmyPEe++AmyPEeeD:NSmP05AZE43ckaufZNMclUNMYl3
TLSH
T1E8910352ABF41119F3F74F81DAF6586B9A32BC611D19E9AD01950A0E08B3F11EC70B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REG2B0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2B0E.tmp
Size 49KB
SHA256 4e848277b5f7c76be3840b4266566b73d8efd473950816dc11e1cb86705bdf5d
MD5 6fccb64d02306a4c4067da216940058c
SHA1 b8accc9f2a2cdee31e7323e5886b5d7a903bf921
SHA512 3a38499cb57ee70bcafe547342734e7b3dd5c0b9f6e7a0c0b8f14a4d62193e0380f81fa61e1fd339752fb8538c80861d653501bd7f1c5821cf59f02ec98a7103
SSDEEP 768:CP8drRVOtTGaOvpzHcvBUYgrZBH9paBJKSvRP6mzE9OUMCIEHE0vPECXjFUaQc3Q:+
TLSH
T11E33B702DFFB2105F2F35B91ADFAA56347357A982A1A948E10D01B4D4DF1F069C227BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REG2B6B.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2B6B.tmp
Size 2KB
SHA256 da40c1b8a8836dcc9986e6b9d33802e11c3a419c639771a80e7969382cf75fd8
MD5 e0076555ebabde8113a34586216e6c51
SHA1 9a696d27d762f681cb6130095b1d1c8e101b7734
SHA512 bb0363dec3cbc0585413dafc663c6aeb9618aa44e56900c07c45e0fd95d39f4da34e31a9b19b4cdffda2dca99a7a481862ea22d3478fd134122a40b947e177ba
TLSH
T1CB41FC125BF62008F5B71F96DEFAE4670736BE552E6AC49E10D42B4E4DF2B0084623E7
MD5 SHA1 SHA512 TLSH

Submit Download

REG2BC9.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2BC9.tmp
Size 304B
SHA256 cfeeb15eb9088ee0061c3ac1c5f242ed8e5737633d25bf233c5cddfdf901640a
MD5 71d8014fe76ec577047381ac5b2f47c5
SHA1 bcb4e25915aa722859695e195efeed9f198a6e9c
SHA512 19b828d578f9d2f7b68ca42db0da5479ac06e967e0205a25101a3ce59465dd4cec058ec5098a9b5bd3f7352a338b8579d757fef74d967f220493d49a2a2ad812
TLSH
T1FEE0121217F51509F6F71F850AE5A5269F37A9982D25D4CD1184474B4AF0A50C8313BB
MD5 SHA1 SHA512 TLSH

Submit Download

REG2C08.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2C08.tmp
Size 9KB
SHA256 2d179ba783fa4c58ba1b40f813d5096445ef251abdace2567cbb6af9cd07063b
MD5 fee7afd4b62ca06de0edca15bb169b2e
SHA1 c15bf9b4bec667950d0515a12844adfd6d4ecda1
SHA512 a36de82fd4c2927fa8b758cb600e1d4c25c00b0896c03032829eacf7131c73d1bc42417c6447480595b181358c8cf2770646c66b83c266dd433ff51e879f0af9
SSDEEP 192:fPDLD1D9DhDADwD8ODPDzDcDeD4D2DRDnDITDZ:fc
TLSH
T13F12B1125BFA2509F3B32F858AF9A5679737B9582A1EC09E10D04B4E0DF1750E8317BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REG2C75.tmp

Path C:\Users\Admin\AppData\Local\Temp\REG2C75.tmp
Size 5KB
SHA256 f57325bd57109d77805e4b8e20d2aa7e00df29dfcd77482cfb16aaa24acf3b4a
MD5 c69900cbd18e50689628de700759c3cb
SHA1 6ef02af6604acab75341cb1434d14adbf3b1583d
SHA512 df93c1c018d4e8f014b94824b0a73056f29b44668b85d234b0dec23380463578856bc18924d1ebe5f5c072cccdaba8ab5d0984f3e2e6637ce2963d3051167fe3
SSDEEP 96:03F/MHW+mr6dctU6W5xYC64ic6/cfAd8zcac7c7sJdlzcvlQJdlzSJ4d8zQipcCK:2dtASKxYXEfx4lwAx4Gx8Z4CI1oSrh
TLSH
T15AB1503ADBA63555A3B24F65DFE34423F6A63452353DC98904C22B4948E1B48E4F23BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_s24fpb4n.4c2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s24fpb4n.4c2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1696-0-0x0000019449820000-0x0000019449830000-memory.dmp

Download

memory/1696-7-0x0000019462610000-0x0000019462632000-memory.dmp

Download

memory/1696-9-0x0000019449820000-0x0000019449830000-memory.dmp

Download

memory/1696-10-0x0000019449820000-0x0000019449830000-memory.dmp

Download