babdfeb99600f4c877ff8513ea510264caa20fdac70b2ce677275759e6df30d6

Analysis

user interaction
yes
max time kernel
37s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dildomenü 2.0.bat
Size 1KB
Sample261009-vybs8sdb34
SHA256 babdfeb99600f4c877ff8513ea510264caa20fdac70b2ce677275759e6df30d6
MD5 3f837fde2706209ec0ff88509ad01c00
SHA1 22ff714d9428646bd422a6f50bb61604e47e3a8b
SHA512 027926bf5cf4957f8445420be89ffe4439d9191a15dcaec1ced519885a99297db63e4c804fd9af9743d7903c621bc6d8d375079a7e6896d365961960d7301b0d
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7540	cmd.exe
4304	cmd.exe
3396	cmd.exe
7688	cmd.exe
4600	cmd.exe
7660	cmd.exe
3944	cmd.exe
1328	cmd.exe
2336	cmd.exe
4312	cmd.exe
3888	cmd.exe
1988	cmd.exe
7328	cmd.exe
4180	cmd.exe
4488	cmd.exe
1072	cmd.exe
7420	cmd.exe
1904	cmd.exe
1648	cmd.exe
4912	cmd.exe
7664	cmd.exe
7720	cmd.exe
4748	cmd.exe
548	cmd.exe
4612	cmd.exe
6396	cmd.exe
7736	cmd.exe
4800	cmd.exe
1548	cmd.exe
4900	cmd.exe
4648	cmd.exe
1132	cmd.exe
7804	cmd.exe
4300	cmd.exe
4388	cmd.exe
3348	cmd.exe
6444	cmd.exe
7672	cmd.exe
3260	cmd.exe
7292	cmd.exe
3496	cmd.exe
8136	cmd.exe
1436	cmd.exe
2032	cmd.exe
1236	cmd.exe
816	cmd.exe
1812	cmd.exe
1624	cmd.exe
7504	cmd.exe
4148	cmd.exe
3344	cmd.exe
3092	cmd.exe
1732	cmd.exe
4624	cmd.exe
2724	cmd.exe
4348	cmd.exe
6096	cmd.exe
1592	cmd.exe
7704	cmd.exe
7780	cmd.exe
3804	cmd.exe
2860	cmd.exe
4440	cmd.exe
4140	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
8636	powershell.exe
8636	powershell.exe
8636	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	8636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4304	4312	cmd.exe	89
PID 4312 wrote to memory of 4148	4312	cmd.exe	91
PID 4312 wrote to memory of 4624	4312	cmd.exe	93
PID 4312 wrote to memory of 1436	4312	cmd.exe	95
PID 4312 wrote to memory of 4400	4312	cmd.exe	97
PID 4312 wrote to memory of 1732	4312	cmd.exe	99
PID 4312 wrote to memory of 1236	4312	cmd.exe	100
PID 4312 wrote to memory of 4912	4312	cmd.exe	101
PID 4312 wrote to memory of 1548	4312	cmd.exe	102
PID 4312 wrote to memory of 2336	4312	cmd.exe	104
PID 4312 wrote to memory of 3092	4312	cmd.exe	105
PID 4312 wrote to memory of 3396	4312	cmd.exe	106
PID 4312 wrote to memory of 1132	4312	cmd.exe	107
PID 4312 wrote to memory of 3348	4312	cmd.exe	108
PID 4312 wrote to memory of 4348	4312	cmd.exe	109
PID 4312 wrote to memory of 3324	4312	cmd.exe	113
PID 4312 wrote to memory of 392	4312	cmd.exe	116
PID 4312 wrote to memory of 4800	4312	cmd.exe	119
PID 4312 wrote to memory of 1536	4312	cmd.exe	122
PID 4312 wrote to memory of 2564	4312	cmd.exe	123
PID 4312 wrote to memory of 3344	4312	cmd.exe	125
PID 4312 wrote to memory of 1624	4312	cmd.exe	126
PID 4312 wrote to memory of 4648	4312	cmd.exe	128
PID 4312 wrote to memory of 1988	4312	cmd.exe	129
PID 4312 wrote to memory of 864	4312	cmd.exe	131
PID 4312 wrote to memory of 1328	4312	cmd.exe	133
PID 4312 wrote to memory of 4692	4312	cmd.exe	134
PID 4312 wrote to memory of 3888	4312	cmd.exe	136
PID 4312 wrote to memory of 3808	4312	cmd.exe	137
PID 4312 wrote to memory of 4812	4312	cmd.exe	139
PID 4312 wrote to memory of 4392	4312	cmd.exe	141
PID 4312 wrote to memory of 3852	4312	cmd.exe	142
PID 4312 wrote to memory of 4736	4312	cmd.exe	144
PID 4312 wrote to memory of 1040	4312	cmd.exe	145
PID 4312 wrote to memory of 920	4312	cmd.exe	147
PID 4312 wrote to memory of 4600	4312	cmd.exe	149
PID 4312 wrote to memory of 4900	4312	cmd.exe	150
PID 4312 wrote to memory of 4748	4312	cmd.exe	152
PID 4312 wrote to memory of 2276	4312	cmd.exe	155
PID 4312 wrote to memory of 1648	4312	cmd.exe	156
PID 4312 wrote to memory of 4128	4312	cmd.exe	158
PID 4312 wrote to memory of 4612	4312	cmd.exe	160
PID 4312 wrote to memory of 1044	4312	cmd.exe	162
PID 4312 wrote to memory of 2032	4312	cmd.exe	163
PID 4312 wrote to memory of 3944	4312	cmd.exe	166
PID 4312 wrote to memory of 788	4312	cmd.exe	168
PID 4312 wrote to memory of 2704	4312	cmd.exe	169
PID 4312 wrote to memory of 2676	4312	cmd.exe	170
PID 4312 wrote to memory of 4436	4312	cmd.exe	172
PID 4312 wrote to memory of 3260	4312	cmd.exe	173
PID 4312 wrote to memory of 1760	4312	cmd.exe	175
PID 4312 wrote to memory of 4300	4312	cmd.exe	177
PID 4312 wrote to memory of 2924	4312	cmd.exe	179
PID 4312 wrote to memory of 2724	4312	cmd.exe	181
PID 4312 wrote to memory of 4028	4312	cmd.exe	183
PID 4312 wrote to memory of 2080	4312	cmd.exe	185
PID 4312 wrote to memory of 4140	4312	cmd.exe	187
PID 4312 wrote to memory of 1960	4312	cmd.exe	189
PID 4312 wrote to memory of 3844	4312	cmd.exe	190
PID 4312 wrote to memory of 4388	4312	cmd.exe	191
PID 4312 wrote to memory of 1072	4312	cmd.exe	193
PID 4312 wrote to memory of 1904	4312	cmd.exe	194
PID 4312 wrote to memory of 1812	4312	cmd.exe	196
PID 4312 wrote to memory of 4440	4312	cmd.exe	198

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dildomenü 2.0.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:1284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:4180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:6368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:6388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:6396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:6404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:6444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:7328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:7420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:7440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:7468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:7492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  - Executes a command shell one-liner
  PID:7504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color a
  2⤵
  PID:7616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:7624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:7632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:7664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:7672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:7688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:7704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:7720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:7740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  PID:7828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:8136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:7292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color b
  2⤵
  - Executes a command shell one-liner
  PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  PID:7436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  PID:7488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:7540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:7660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:7780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:7736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  - Executes a command shell one-liner
  PID:7804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K color c
  2⤵
  PID:8148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_un4jdkpv.rex.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_un4jdkpv.rex.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8636-10-0x000002B76AB80000-0x000002B76ABA2000-memory.dmp

Download

memory/8636-11-0x000002B76B080000-0x000002B76B0C4000-memory.dmp

Download

memory/8636-12-0x000002B76D880000-0x000002B76D8F6000-memory.dmp

Download