6d2588ebe160fb4965aaf667c310bf240732a9835c8132d0f5af68b9a532d839

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PUBG-Tool.exe
Size 1.6MB
Sample261110-xlfb1aaa72
SHA256 6d2588ebe160fb4965aaf667c310bf240732a9835c8132d0f5af68b9a532d839
MD5 0cdf569a8ec058816121f8853a9dd005
SHA1 9d31c4df10aa0f5fcc01a900edc6bcbcc9aaef0d
SHA512 be786ce2c89bba5c3a8455b7142b4da1370ebec0c9d29756fbcc73acc7ca1e33d1e1990d5528c8d68ad7eb529576a6be193bc715dfd665ab4d8994f508e3fbbd
SSDEEP 24576:4BzM5lGIH1lRDWig0ZhLrcFh0lhSMXlMLjkK4XL/KRrSHuYdK:MzG7ZhZBfL/c6E
TLSH
T10375AE16AB9C20A7D86F827C84398606E6B57C960368C6DF37D6C5980F137E4BD36393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
368	powercfg.exe
4584	powercfg.exe
1560	powercfg.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PUBG-Tool.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PUBG-Tool.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
456	powershell.exe
456	powershell.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
1892	powershell.exe
1892	powershell.exe
2096	powershell.exe
2096	powershell.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4588	powershell.exe
4588	powershell.exe
4304	powershell.exe
4304	powershell.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe
4212	PUBG-Tool.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	PUBG-Tool.exe
Token: SeShutdownPrivilege	1560	powercfg.exe
Token: SeCreatePagefilePrivilege	1560	powercfg.exe
Token: SeShutdownPrivilege	368	powercfg.exe
Token: SeCreatePagefilePrivilege	368	powercfg.exe
Token: SeShutdownPrivilege	4584	powercfg.exe
Token: SeCreatePagefilePrivilege	4584	powercfg.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeIncreaseQuotaPrivilege	456	powershell.exe
Token: SeSecurityPrivilege	456	powershell.exe
Token: SeTakeOwnershipPrivilege	456	powershell.exe
Token: SeLoadDriverPrivilege	456	powershell.exe
Token: SeSystemProfilePrivilege	456	powershell.exe
Token: SeSystemtimePrivilege	456	powershell.exe
Token: SeProfSingleProcessPrivilege	456	powershell.exe
Token: SeIncBasePriorityPrivilege	456	powershell.exe
Token: SeCreatePagefilePrivilege	456	powershell.exe
Token: SeBackupPrivilege	456	powershell.exe
Token: SeRestorePrivilege	456	powershell.exe
Token: SeShutdownPrivilege	456	powershell.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeSystemEnvironmentPrivilege	456	powershell.exe
Token: SeRemoteShutdownPrivilege	456	powershell.exe
Token: SeUndockPrivilege	456	powershell.exe
Token: SeManageVolumePrivilege	456	powershell.exe
Token: 33	456	powershell.exe
Token: 34	456	powershell.exe
Token: 35	456	powershell.exe
Token: 36	456	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeIncreaseQuotaPrivilege	1892	powershell.exe
Token: SeSecurityPrivilege	1892	powershell.exe
Token: SeTakeOwnershipPrivilege	1892	powershell.exe
Token: SeLoadDriverPrivilege	1892	powershell.exe
Token: SeSystemProfilePrivilege	1892	powershell.exe
Token: SeSystemtimePrivilege	1892	powershell.exe
Token: SeProfSingleProcessPrivilege	1892	powershell.exe
Token: SeIncBasePriorityPrivilege	1892	powershell.exe
Token: SeCreatePagefilePrivilege	1892	powershell.exe
Token: SeBackupPrivilege	1892	powershell.exe
Token: SeRestorePrivilege	1892	powershell.exe
Token: SeShutdownPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeSystemEnvironmentPrivilege	1892	powershell.exe
Token: SeRemoteShutdownPrivilege	1892	powershell.exe
Token: SeUndockPrivilege	1892	powershell.exe
Token: SeManageVolumePrivilege	1892	powershell.exe
Token: 33	1892	powershell.exe
Token: 34	1892	powershell.exe
Token: 35	1892	powershell.exe
Token: 36	1892	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeIncreaseQuotaPrivilege	2096	powershell.exe
Token: SeSecurityPrivilege	2096	powershell.exe
Token: SeTakeOwnershipPrivilege	2096	powershell.exe
Token: SeLoadDriverPrivilege	2096	powershell.exe
Token: SeSystemProfilePrivilege	2096	powershell.exe
Token: SeSystemtimePrivilege	2096	powershell.exe
Token: SeProfSingleProcessPrivilege	2096	powershell.exe
Token: SeIncBasePriorityPrivilege	2096	powershell.exe
Token: SeCreatePagefilePrivilege	2096	powershell.exe
Token: SeBackupPrivilege	2096	powershell.exe
Token: SeRestorePrivilege	2096	powershell.exe
Token: SeShutdownPrivilege	2096	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4212	PUBG-Tool.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4212	PUBG-Tool.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3332	4212	PUBG-Tool.exe	86
PID 4212 wrote to memory of 1560	4212	PUBG-Tool.exe	89
PID 4212 wrote to memory of 368	4212	PUBG-Tool.exe	91
PID 4212 wrote to memory of 4584	4212	PUBG-Tool.exe	93
PID 4212 wrote to memory of 1808	4212	PUBG-Tool.exe	95
PID 4212 wrote to memory of 456	4212	PUBG-Tool.exe	97
PID 4212 wrote to memory of 1892	4212	PUBG-Tool.exe	102
PID 4212 wrote to memory of 2096	4212	PUBG-Tool.exe	104
PID 4212 wrote to memory of 4588	4212	PUBG-Tool.exe	106
PID 4212 wrote to memory of 4304	4212	PUBG-Tool.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PUBG-Tool.exe
"C:\Users\Admin\AppData\Local\Temp\PUBG-Tool.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "PUBG Tool (FLOKI)"
  2⤵
  PID:3332
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "PUBG Tool (FLOKI)"
  2⤵
  PID:1808
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoAJABrACAAPQAgAEAAKAAnACoARQBFAEUAJwAsACcARQBFAEUAJwAsACcAQQBkAHYAYQBuAGMAZQBkAEUARQBFACcALAAnAEUAbgBhAGIAbABlAEcAcgBlAGUAbgBFAHQAaABlAHIAbgBlAHQAJwAsACcAUABvAHcAZQByAFMAYQB2AGkAbgBnAE0AbwBkAGUAJwAsACcARwBpAGcAYQBMAGkAdABlACcALAAnACoAUwBlAGwAZQBjAHQAaQB2AGUAUwB1AHMAcABlAG4AZAAnACkAOwBHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAQQBkAHYAYQBuAGMAZQBkAFAAcgBvAHAAZQByAHQAeQAgAC0ATgBhAG0AZQAgACcARQB0AGgAZQByAG4AZQB0ACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABrACAALQBjAG8AbgB0AGEAaQBuAHMAIAAkAF8ALgBSAGUAZwBpAHMAdAByAHkASwBlAHkAdwBvAHIAZAAgAC0AYQBuAGQAIABbAHMAdAByAGkAbgBnAF0AJABfAC4AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAC0AbgBlACAAJwAwACcAIAB9ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AJwAgAC0AZgAgACQAXwAuAFIAZQBnAGkAcwB0AHIAeQBLAGUAeQB3AG8AcgBkACwAIAAoAFsAcwB0AHIAaQBuAGcAXQAkAF8ALgBSAGUAZwBpAHMAdAByAHkAVgBhAGwAdQBlACkAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoARQByAHIAbwByAC4AVwByAGkAdABlAEwAaQBuAGUAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQA7ACAAZQB4AGkAdAAgADEAIAB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e863b592f690b808fdec62c59df21a9b967119239b21ba821594a6932b0e2888
MD5 4d8b4c9fd65a81007f80a5ab9697cb9d
SHA1 a79b4f6739219c33142394af809e91d128e72499
SHA512 5e88699065475cdbf6cd0b454b5dbc3960dac7d43bf570be35755790ba53aaed9c47bdbf345208f8976fc9d7f67eb228c555a1381908bd2b4bb4038ad20077c7
TLSH
T137217423B39D8820CC9A163A109CAC5172A686CB80DECF9F2EC0C21191BFAC8CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2b9c3614485b2aa7d727d797ef6198a6b51d80fffbf9431ac06c81788013933f
MD5 72e16dc1903b863bafb7ef537e3e7703
SHA1 e40e5d2da12c3ad2f67f25f49647e54b4507b55b
SHA512 6eb86a76a361fb17179f80de52dc7dc1905036f5bb752a4a59b29aebb88f7e5e3e80ee8394b6a82894c3ee93cecd4a7f3074f5ea8effaa17d25d5fe31693d65d
TLSH
T1E0219727B3DD8820CCDA163A109CAC5572A686CB80DFDF9F2FC0C21195BF6C8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2e1d2b0a86abe46d40843dbc522f6c9891671b21c1ac61e21d32f7245a93eb8b
MD5 c8c29f1f588816cb69fcebf642891720
SHA1 968d91f771b5e235c91952025509479c4456b44e
SHA512 6b19696757654762ec551388c04142d4404892314c3e8a811b3260834dd6110b57be9aa4a0497ff579a4936c91cbdfbf7a938f676ee24e7476ecdd1b668cac3a
TLSH
T1E6217423B39D8820CC9A163A109C9C5172A686CB80DECF9F2EC0C21195BFAC9CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e4b7cba2b8b22ff90b62b0a462137207b8c801e5c82d8130aa4129ddb1bb6881
MD5 17220e43826a321b91237968b1f2fc35
SHA1 f8731a6d16e7bdc32e1e758e974d56976fe62253
SHA512 30aa77e58378ba32471902775acc0a4250cab9b6abf989aa4ba956e2d8d2e6592f7f52bf12d9f6fd53824dccf118f67a5c309fec9d397355e99f64bcffb01384
TLSH
T1F9217423B38D8820CCEA163A109C9C5172A686CB81DFDF9F2EC0C21191BFAC8CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_w30kxy3v.hv4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w30kxy3v.hv4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-9-0x00000187F2700000-0x00000187F2722000-memory.dmp

Download

memory/4212-8-0x000001C5E2E30000-0x000001C5E2E40000-memory.dmp

Download

memory/4212-0-0x000001C5E2840000-0x000001C5E29D6000-memory.dmp

Download

memory/4212-6-0x000001C5E2E40000-0x000001C5E2E4E000-memory.dmp

Download

memory/4212-5-0x000001C5FE990000-0x000001C5FE9C8000-memory.dmp

Download

memory/4212-4-0x000001C5E2E20000-0x000001C5E2E28000-memory.dmp

Download

memory/4212-3-0x000001C5E2E30000-0x000001C5E2E40000-memory.dmp

Download

memory/4212-2-0x000001C5E2E30000-0x000001C5E2E40000-memory.dmp

Download

memory/4212-1-0x000001C5E2E30000-0x000001C5E2E40000-memory.dmp

Download

memory/4212-57-0x000001C5E2E30000-0x000001C5E2E40000-memory.dmp

Download

memory/4212-58-0x000001C5E2E30000-0x000001C5E2E40000-memory.dmp

Download