85e84b9544d4b794d23b4d19f9010778bcd8cce2604b0fc3dda7cc5579abb5cc

Analysis

max time kernel
898s
max time network
727s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps2DLC/loadGAC.ps1
Size 2KB
Sample261002-pyra2asgnb
SHA256 85e84b9544d4b794d23b4d19f9010778bcd8cce2604b0fc3dda7cc5579abb5cc
MD5 c852de1df1474d82fea09236e42c137f
SHA1 cbf36c1b0e112d134285ea6aade12b95088a32d0
SHA512 e182a11e4c795dd08ea05b4fcaff946552a0a4306105c5bf7aadd669432f5458d13f5cd319a59f4a82f80f3a0b03e728c80bcf03b2484491f089d3b57e7b50df
TLSH
T1F05142616E8BE3309AB20B498E018945ED5900A9C65B5844F7CCE75CFFF520D4770A7F
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	PowerShell.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File created	C:\Windows\assembly\tmp\AU7WLZCC\Microsoft.WSMan.Management.dll	PowerShell.exe
File created	C:\Windows\assembly\GACLock.dat	PowerShell.exe
File created	C:\Windows\assembly\tmp\E07B02QP\Microsoft.PowerShell.Security.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\7L3K3ZRELL\Microsoft.PowerShell.Commands.Diagnostics.resources.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\AKV724JL\Microsoft.PowerShell.ConsoleHost.resources.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\F7I7AR1W76\Microsoft.PowerShell.Security.Resources.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\ELYWCBTQ\Microsoft.WSMan.Management.resources.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\3YE78RWF\Microsoft.PowerShell.Security.resources.dll	PowerShell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	PowerShell.exe
File created	C:\Windows\assembly\tmp\5RK9X24H\Microsoft.PowerShell.Commands.Management.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\JQ0XCXS0GT\Microsoft.PowerShell.Commands.Utility.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\2GGII6C8\Microsoft.WSMan.Runtime.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\7GWD5F4WNE\Microsoft.PowerShell.Commands.Management.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\EYC2PV0Q\Microsoft.PowerShell.ConsoleHost.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\A6RXNJ65\Microsoft.PowerShell.Commands.Diagnostics.resources.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\AXY0QU9J\Microsoft.PowerShell.Commands.Management.resources.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\IO0DVXD831\Microsoft.WSMan.Management.resources.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\3IDP4IUTEJ\Microsoft.PowerShell.Security.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\G88Y1W8R\Microsoft.PowerShell.Commands.Utility.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\QSLY1YHK\pspluginwkr.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\97JLFUBHWU\Microsoft.PowerShell.Commands.Management.Resources.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\43LGIVE3\Microsoft.PowerShell.Commands.Utility.resources.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\454B0LQIVR\Microsoft.PowerShell.Commands.Utility.Resources.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\3QMPBJ17AU\Microsoft.PowerShell.ConsoleHost.Resources.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\5FV4YRRW\System.Management.Automation.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\MV5XFTM4\Microsoft.PowerShell.Commands.Diagnostics.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\8D7A4ZHHDX\Microsoft.PowerShell.Commands.Diagnostics.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\5U7CYXZHBE\Microsoft.PowerShell.ConsoleHost.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\V70X9Y7B3Y\Microsoft.WSMan.Runtime.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\C5LSN5SZRF\System.Management.Automation.Resources.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\EOHNOTOEBE\Microsoft.WSMan.Management.dll	PowerShell.exe
File opened for modification	C:\Windows\assembly\temp\KVA17K7KO8\System.Management.Automation.dll	PowerShell.exe
File created	C:\Windows\assembly\tmp\7ADFDIPL\System.Management.Automation.resources.dll	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4792	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4792	PowerShell.exe
4792	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4104	4792	PowerShell.exe	90
PID 4792 wrote to memory of 3256	4792	PowerShell.exe	91

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps2DLC\loadGAC.ps1
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" import C:\Users\Admin\AppData\Local\Temp\ps2DLC/regkeysNew/regkeyPowerShell.reg
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" import C:\Users\Admin\AppData\Local\Temp\ps2DLC/regkeysNew/regkeyPowerShellEngine.reg
  2⤵
  PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4952

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_iwyrcpvm.fox.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwyrcpvm.fox.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 160KB
SHA256 931b7f2b286fd681286d2a0972cd6eb4284a03c1e22712cdd620cbe933f66eb0
MD5 4b00f84116bef4e70d4511219d3d71c5
SHA1 4f920d2569c0176d54f3fb676d9c9bd9e0164f9d
SHA512 5761a459a4ad64036af6651c7cdedfdf1c6e3a57d31e8658874b0586b3594ba1ab24d90f5faf85a1e7c7d3c835472105c53052001941d154668d11005a3d53ba
SSDEEP 1536:PO1uWuuA+Vsy8guWqAYC8Cm+S0qQWKaCX4T0Cy/a+GWiSsgw+mibNpE2mK6qQKCM:ZyowDTc7/dhe8HU
TLSH
T185F32319112D91916E9363C219A82B97A3CF4B9B6BBC076CF779362C9E4704F63311F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WSMan.Runtime.dll

Path C:\Windows\assembly\tmp\2GGII6C8\Microsoft.WSMan.Runtime.dll
Size 7KB
SHA256 8af7b2ea211ba948944fdc9d2e8e47c72234a1497b872893eb340bf503bcc9ed
MD5 fd9dc207646a40f715b2e3fa12ff8b2f
SHA1 c314d4bdb1c844328a211edee932e8c7c807bc3f
SHA512 a07bfa06e0bcd1e3435c940b8c4d10342e6982730a028df50cf929127840c877da50f346f74f8fd35ef00e3c949fda78338ba99473ed8b5f56a4ef216b8cbdea
SSDEEP 96:Y5Sap1fDmuDfOYkuPF3+0DqQ4NVe7EUsdTp5lqbPzKx0I+DzD5hw7nWhg95Wb:YMomuDfOY1kQ4NVe7Ej0zKWirW
TLSH
T175E1850293D8C72AFBBE1737E87307922735AB16A913CB6A154171093C1778AC9637F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Security.resources.dll

Path C:\Windows\assembly\tmp\3YE78RWF\Microsoft.PowerShell.Security.resources.dll
Size 9KB
SHA256 d22da4ecf86a904e73cf5e91d7ed7d5dd9d9f4f7ccc5064c4f0278a5aaca77fa
MD5 c4a74fa93f0fdae5e72e4ae147fe242b
SHA1 44e7f3e5738b3fde6a1b2db7fc3cbcbe1dc083e1
SHA512 8987d63890062f5884cfd7707283f4967159a1f2a6f82ba14912f0841802e507479c21780f1245341bcf44e3e78f6e6a598023a63b02f37e7efed18f8dacebe3
SSDEEP 96:VFcRKtGeDt/M3oN/F4fSHDGFg7e5GfJRDEI5+WvCRqwpFJbTp/1kWlAHW:VFmCzqFg7OI5+Wv6z7GWlAHW
TLSH
T1BA12451217FC4636F6F20B36257A27C2573BBA59D231C62D6854011D39B2B25CF92BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Commands.Utility.resources.dll

Path C:\Windows\assembly\tmp\43LGIVE3\Microsoft.PowerShell.Commands.Utility.resources.dll
Size 48KB
SHA256 eb4303bfc7d649b7c1f32ad7b58ad584d4f83b2cea1467d7e6e19037ac2a9397
MD5 b32152df054633a28f4d5e2aeddf5f19
SHA1 eee94d9e364f4d5e34c2464d4878c8f65b5b96f9
SHA512 dc14a22c6065cfe2b43b80d2894166fb149a566e0d61e9f1aa2053caeed0aa42a6e008f86363bf3343c66aba150bbf97ab8b230613cb9b326cadf34d570a6661
SSDEEP 768:zFFbjeHT41pFYrtQauJqkMWQTLwbz9omz/fGVq0CE:n3eNrtQ9JqpXKom7mq0T
TLSH
T19323941633FC0139F9F30B763A79A2900A3BF9697730DA5E4054451D29B2A51DAE3BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Management.Automation.dll

Path C:\Windows\assembly\tmp\5FV4YRRW\System.Management.Automation.dll
Size 2.9MB
SHA256 1c6dd7935a15c026f69c6f687f21b83d06c69fa089ed26b10fe2a08e68fe1acb
MD5 6ca7d39d5e569cc91538dd29b88fdaea
SHA1 c669667bb4d7870bc8bb65365d30071eb7fb86fe
SHA512 dc43da507c93a121235134b7acc4508bcd45bb9084852d4d39ab508c53fc41a44d386340c303865c1200d43b0f5c1a401d98958fea9fa6ddab10c3fbd0587610
SSDEEP 24576:N+3JJmqlMky1OVC64CZfftlMDXXZ4bwgEaJiY93bVfZo0VxHccM81rNq0Rxg/pOP:NI1C6htl8X1gnJHRfL5q0Rxg/pO
TLSH
T107D5F605B3EE0E5AE4BB4779A479101446F7FC166B33D74F2548A1AA1EB3B80CD523A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Commands.Management.dll

Path C:\Windows\assembly\tmp\5RK9X24H\Microsoft.PowerShell.Commands.Management.dll
Size 284KB
SHA256 a50a7b64e9d4493ab5fbf6b7e9f0491c0df0cd5d1e02f602f1502cbd23fda0a3
MD5 7e7871c535247ea9307874e2dc2fa240
SHA1 eec0e4259e7697a3bf6abee6857d0cb09583d9ad
SHA512 a19cc860d496475d45dd2755a06b2fe31cbca4ac380122ef22f4c61197ad950a721f48369b48f696aa4c10df9a927772afab02b014afa13ab122ee58daa5f016
SSDEEP 3072:uGw5avcUoghuthuM1isTUlez1rNKXyK0MrN/t+qQmGUU+jr52AFha2dUHhqG7cO3:G7YGZ7cOEwaPwOQcp9DaLhSJ
TLSH
T16154F71033FE8E9AE29F0AB9B47016514772F916BF56E71F4C80909F1E77B94CA12263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Management.Automation.resources.dll

Path C:\Windows\assembly\tmp\7ADFDIPL\System.Management.Automation.resources.dll
Size 248KB
SHA256 8f27f759193dd36b728bcc20ded1a4377b5de3b55e899fb43e857fbdac495e7a
MD5 49d669dd9f8f3d4d8600d94efb46edf8
SHA1 a17a7f4138ff417c5607bd49914a592a63e3594b
SHA512 dfe5e6f5ba2a27e355e33fd640c686bd52191c8b7de17bd4eb6d0f1495dedb7aa823e56ffc891feca2159c51fb67a5d2ff7a6da10fb3b29533f5e789447a3107
SSDEEP 3072:P2P4Au292wyXHxU2lqHOIKPI4lGuo/Do+nxq5OqXjcZ6pSV2ILV:Piu292wyXxnIKPGuoPqTc82L
TLSH
T1BC44931677F80279F5F30B757A7E90948E3BBC642A20D15D2058414E2A72E60CAF7BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Commands.Diagnostics.resources.dll

Path C:\Windows\assembly\tmp\A6RXNJ65\Microsoft.PowerShell.Commands.Diagnostics.resources.dll
Size 10KB
SHA256 9f9a02bf5d7d81ff9c8604c18d097db7c4aea3f4742fdd9c71cf0b37fd1e5b21
MD5 379089fde4608b9401ec95b274542576
SHA1 4b475c3bddf1953f89e915cf65fa32ed1f5fde69
SHA512 b884269318b45638429af524a69e2c9eabd5a6b65ce7c48996c5d582e76c6aab710634076e370dfb617b44327f595d6a03550b564b1a0de71d03577405680d55
SSDEEP 192:62otYeumtobrzJzCEQqMAiWakK2sWlgHW:lSEJzCEQqZiWK2sWlgHW
TLSH
T18A22630767F9061AF5F20BF53B789252A63AF9B9BE32C75D10A4050C24B2D5085F6BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.ConsoleHost.resources.dll

Path C:\Windows\assembly\tmp\AKV724JL\Microsoft.PowerShell.ConsoleHost.resources.dll
Size 40KB
SHA256 bcd10cafe2e9f52156f0c08275ff5c25b9e218e41cfe7cd162b844416efd7eff
MD5 3e0109ea8ae395107ba33d20feb651b0
SHA1 f4f3438873f155e0b5e327d4f7995067151fedc4
SHA512 d7346e5a99656c6b8362fc67796d47e75a5bd08f783a65701fd18c5d2b8dc11c6ce746aa18c6a65fbf0457f3662d8df817e8b31333355bc7bd2ae62b3a49c8ef
SSDEEP 768:wVF9ukn9QhlhetVxGXf1KFYaxvboRvnnr+ok1zH8f1hFX4IedkKfLRqh:o9/9QvFhZedffc
TLSH
T18803B43337FD0674F9F20A352D7AA2855A3FBEB22171D26E6054011C2BB6A94C5D23B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WSMan.Management.dll

Path C:\Windows\assembly\tmp\AU7WLZCC\Microsoft.WSMan.Management.dll
Size 280KB
SHA256 f2a3648895f9208b929be0aa4a5d2876f637508c4670198c394ddea732346a65
MD5 5ed84a6af55bf182fea7f38693e335f4
SHA1 f6b17daf9a0c0493e281d7b6c61dadb57cec0048
SHA512 759d6939fcae07037af4fbc8615068149d16bf5322aed26ff479dfb62f38ce12a0254b60c0b2de07f6adea956bdb695d1c4e1cbd9009645fa768ae47ac708a47
SSDEEP 3072:U0mu0JKz11uPU68EsrCQhpLJc7961YGGgrtk4143aDHhL1GfVjUa6vNRM91VFO0N:Rr114grCS43aDHhL1GfVjlA691Vg0Ia
TLSH
T18054E821B3F98DAFD5EE063E7074840369B963C35870DFAFAE4478568837788C51276A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Commands.Management.resources.dll

Path C:\Windows\assembly\tmp\AXY0QU9J\Microsoft.PowerShell.Commands.Management.resources.dll
Size 36KB
SHA256 5c16a02e12984076810343331f41719c52c40d263c1a62c89f678e32b369dbf0
MD5 573944e952f9d7f26d617fab908ee9ee
SHA1 b66d598c5af6636e74f3616609a5d9c205e7ab91
SHA512 a2d9d9dd616f8899139b4d2c8862858c39406c409bbeebd5e11575df9d31293ff5b7ddcc9ad9904bf9b2de922567aca2d1c68d2c67301ff7f0c8eac8907f3b7a
SSDEEP 384:OF8Tz+zhGF3rushkHBbZaJQ/Q1eYMTOK6tl9vp6f6APROV0IOttZl6Rmi5uUWlFB:ONSkH+/l9vp6f66ROVQttZYul
TLSH
T1AAF2841663EC0235F6F20BB1367A61858E37BCB55A30D71E5478420D2AB1A64C6F7BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Security.dll

Path C:\Windows\assembly\tmp\E07B02QP\Microsoft.PowerShell.Security.dll
Size 76KB
SHA256 95c641c9bd8b40b6a3275dca2772181fa57c248f2d33c98180903f241fb8e3b1
MD5 965ff911ac1abd8c30d1ff0bd945a696
SHA1 8bca8c04cd1ca339a2412e0d2d9f296aa2340b28
SHA512 cf1d94275ca3b39f729e053d71d7ca7fc21a1653dcd3dd12d7cc45c2f658e81a31ae08a4028d13fd52c6eba31c594b9a8e0afd1dd20d1e3894f73b773894926b
SSDEEP 768:7Yxz4fbFZoTMuaPQCJiFuGEDfZT1VaVP7V2WKLbTl:Uxz4xZoTMuEQCAFuGa1VaVDV2Wcl
TLSH
T1C873C80967EB8D6BE5990A7495F011C007BEFE177E63E72FCE88009A1873758C691BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WSMan.Management.resources.dll

Path C:\Windows\assembly\tmp\ELYWCBTQ\Microsoft.WSMan.Management.resources.dll
Size 13KB
SHA256 af8559c03ab698bc8bc60a6035f0689842f2e009f0da7e0f8acbf5452162e3b9
MD5 dd6902f80f16e9ebdc289ffb376f921a
SHA1 ede0599faf7b4f94f9acc0bbdde98743c8711523
SHA512 d904502be83662bde01adad2c87a3a773ef2740e996e60fd63255529a71bee9b9bae024ad5c4f2853d5110060bcac2c098165de9dcd278fa127fe560ee77c97a
SSDEEP 384:XU6yrhasWOCQ+mdpeCJc79uYcKSAqwNGbWWlOtW:XU6yrEsrCQhpeCJc79uYc1zwNGk
TLSH
T10652511363FC1639F9F207B16AB993914537B9742B31E30E1479404D2632EA4D6F6BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.ConsoleHost.dll

Path C:\Windows\assembly\tmp\EYC2PV0Q\Microsoft.PowerShell.ConsoleHost.dll
Size 196KB
SHA256 0401bca17d8d2ab46921934fe65ae618884910ac8f4342d2ee9f06da0c4d1113
MD5 4a096a4b77ae0c49d3628ce164eec3c2
SHA1 bf5199baebcf19925e6bc347c308b1a15d9d5e67
SHA512 10ed3c1e9c0b1e70cc13e3ace4b3a3c6b1d27d2f47b88a43dc212d37a436863a2b961e892d0d46812b6ebd9ae5368ea874a33ac17ed17b80277081ad9720eb34
SSDEEP 3072:Xt310/QfNhefeLiB+i5pNp3lOWvjR9WQwy/+mbZSLfc6c:XLRiBP33l9jnLILxc
TLSH
T15914192577FD0A29F5FF0B79687502510B3AFE666923E38E188834ED19B2380C961777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Commands.Utility.dll

Path C:\Windows\assembly\tmp\G88Y1W8R\Microsoft.PowerShell.Commands.Utility.dll
Size 652KB
SHA256 44145af4d2011e8167e31d0b25369eca7cc1e16e69f8c03b587bcd3ff4a15fa1
MD5 610e77e0b1281bb7ef63922a9b0abaab
SHA1 29503068867f09d54b43da22c41c05b794d26676
SHA512 c7ccb0c62baf655641be42e380c3596cec0a941929747c83e67d7b5a0994c971670a9ff8f33fd2ee03f3011441f743451c90b73fb5fd855eecd795248897d1ca
SSDEEP 12288:k4FgaXFD4B9KOiC+ZPr5DFQmYEMIf4bsuU2:x9D4XfiC+ZPRFQmYEjfGsuU2
TLSH
T1A7E4811463F90F16E2FB4BB4A8B504555A77F816EE3AD79F0888119D0AB3B40CD62B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.PowerShell.Commands.Diagnostics.dll

Path C:\Windows\assembly\tmp\MV5XFTM4\Microsoft.PowerShell.Commands.Diagnostics.dll
Size 100KB
SHA256 4d1362c1bd4975fe2ba68e6fbc33597b48415719276b071556116d56cfcaa3d9
MD5 868d052c74b60aca6794fbc4a1f714fd
SHA1 d29cb5a480cf22c480a2d324a5406fb4f161f230
SHA512 e81540043ac01372d81397083b3f56b742ede4c36f9bfac9ab9be67d39a855c2b1c557f27608b47e084d33cbe321626169aca61900909c290d79d98cddcf0a35
SSDEEP 1536:Gy0sfjiW+7MeEdz/t3ZJzVIkedwTVEwz1yMcrMJI6u5fYpG7e/:Gy0sfk7kdDt3PxIkBGwz1yMTzu5fYz
TLSH
T18DA34B0477EF0E1AF8AE0A7EB57014960675BA473F22E55F9ED2288A1D77B40C9107B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4792-24-0x0000026AE0700000-0x0000026AE070A000-memory.dmp

Download

memory/4792-232-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-25-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-0-0x00007FFBF1F4F000-0x00007FFBF1F50000-memory.dmp

Download

memory/4792-119-0x00000000000E0000-0x0000000000112000-memory.dmp

Download

memory/4792-23-0x0000026AE08B0000-0x0000026AE0962000-memory.dmp

Download

memory/4792-125-0x0000026AE0DB0000-0x0000026AE1092000-memory.dmp

Download

memory/4792-22-0x0000026AE0850000-0x0000026AE086E000-memory.dmp

Download

memory/4792-15-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-14-0x0000026AE0710000-0x0000026AE074A000-memory.dmp

Download

memory/4792-13-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-12-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-11-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-221-0x0000026AE0B10000-0x0000026AE0B52000-memory.dmp

Download

memory/4792-231-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-218-0x0000026AE0AC0000-0x0000026AE0B02000-memory.dmp

Download

memory/4792-208-0x0000026AE0850000-0x0000026AE085A000-memory.dmp

Download

memory/4792-205-0x0000026AE0700000-0x0000026AE070A000-memory.dmp

Download

memory/4792-10-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-40-0x0000026AE0AC0000-0x0000026AE0B0A000-memory.dmp

Download

memory/4792-195-0x0000026AE0850000-0x0000026AE0858000-memory.dmp

Download

memory/4792-192-0x0000026AE0700000-0x0000026AE0708000-memory.dmp

Download

memory/4792-181-0x0000026AE0850000-0x0000026AE085E000-memory.dmp

Download

memory/4792-178-0x0000026AE0700000-0x0000026AE070E000-memory.dmp

Download

memory/4792-168-0x0000026AE0850000-0x0000026AE0860000-memory.dmp

Download

memory/4792-165-0x0000026AE0700000-0x0000026AE0710000-memory.dmp

Download

memory/4792-2-0x0000026AE02E0000-0x0000026AE0302000-memory.dmp

Download

memory/4792-155-0x0000026AE0850000-0x0000026AE085C000-memory.dmp

Download

memory/4792-152-0x0000026AE0700000-0x0000026AE070C000-memory.dmp

Download

memory/4792-142-0x0000026AE0850000-0x0000026AE0858000-memory.dmp

Download

memory/4792-139-0x0000026AE0700000-0x0000026AE0708000-memory.dmp

Download

memory/4792-106-0x0000026AE0700000-0x0000026AE0708000-memory.dmp

Download

memory/4792-93-0x0000026AE0AC0000-0x0000026AE0B08000-memory.dmp

Download

memory/4792-8-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-80-0x0000026AE0850000-0x0000026AE0866000-memory.dmp

Download

memory/4792-66-0x0000026AE0AC0000-0x0000026AE0AF4000-memory.dmp

Download

memory/4792-53-0x0000026AE0B70000-0x0000026AE0C16000-memory.dmp

Download

memory/4792-1-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp

Download

memory/4792-27-0x0000026AE0850000-0x0000026AE086C000-memory.dmp

Download