asyncrat | cb22cebed97d6363239f63cf28816b8a8c06977c6d8625a43a61f0afa8823b26

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ModStickInjectorV1.exe
Size 748KB
Sample240627-xj4ltavfld
SHA256 cb22cebed97d6363239f63cf28816b8a8c06977c6d8625a43a61f0afa8823b26
MD5 457143901d9ca2f0bc836c1dd1faefe3
SHA1 11e554dcfca0dd51c5bfe92d35b9c13b21b81691
SHA512 0bd04e37e8f3bb869783661972b83ec8fb6b06727eff27374d2855e714b31cd51b15ada8e46d8b09eda9367dd002f65436785b7962f80f5812396aff3c03c0d0
SSDEEP 12288:Ykpcy+P2t8ysP8ZURBmtxjlk/u6ntgJ2E3P0DtaxoisMLHsXxteTX:Ykpcy5tVZqBmTji/PQP0Zaxd5LHxT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat quasar xworm default slave execution rat spyware trojan

Malware Config

Extracted

Family

xworm

head-experimental.gl.at.ply.gg:46178
best-bird.gl.at.ply.gg:27196
super-nearest.gl.at.ply.gg:17835

Attributes

install_file
USB.exe

Extracted

Family

asyncrat

Botnet

Default

finally-grande.gl.at.ply.gg:25844

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

quasar

Version

3.1.5

Botnet

Slave

stop-largely.gl.at.ply.gg:27116

Mutex

$Sxr-kl1r656AGsPQksTmi8

Attributes

encryption_key
ql4fQ8TV9ZFP9vRX2myA
install_name
$sxr~Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$77STARTUP~MSF
subdirectory
$sxr~SubDir

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233f2-6.dat	family_xworm
behavioral2/memory/1588-24-0x0000000000690000-0x00000000006A8000-memory.dmp	family_xworm
behavioral2/files/0x00070000000233fd-45.dat	family_xworm
behavioral2/files/0x0007000000023400-85.dat	family_xworm
behavioral2/memory/3496-70-0x0000000000860000-0x0000000000878000-memory.dmp	family_xworm
behavioral2/memory/3252-87-0x00000000006E0000-0x00000000006FA000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233fe-41.dat	family_quasar
behavioral2/memory/1428-86-0x0000000000FC0000-0x000000000102C000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x00070000000233ff-54.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe
4452	powershell.exe
4924	powershell.exe
3416	powershell.exe
3984	powershell.exe
1120	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	ModStickInjectorV1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Part 2.exe

Executes dropped EXE 15 IoCs

pid	Process
1588	Part1.exe
952	Part2.exe
3496	Part 1.exe
1428	Part 2.exe
3692	Part 3.exe
4472	Windows PowerShell.exe
3252	Part 4.exe
2180	Part 2.exe
3128	Part 2.exe
3328	Part 2.exe
3952	Part 2.exe
2340	Part 2.exe
1976	Part 2.exe
4848	Part 2.exe
2852	Part 2.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com
15	api.ipify.org
24	ip-api.com
29	ip-api.com
36	ip-api.com
42	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
1284	1428	WerFault.exe	85
2436	2180	WerFault.exe	118
4196	3128	WerFault.exe	141
348	3328	WerFault.exe	150
3896	3952	WerFault.exe	162
4148	2340	WerFault.exe	171
2308	1976	WerFault.exe	180
3652	4848	WerFault.exe	189
752	2852	WerFault.exe	198

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639881070822946"	chrome.exe

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery

T1018

pid	Process
544	PING.EXE
3512	PING.EXE
4124	PING.EXE
4872	PING.EXE
3720	PING.EXE
316	PING.EXE
4480	PING.EXE
4588	PING.EXE
1244	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1800	schtasks.exe
1416	schtasks.exe
3328	schtasks.exe
3380	schtasks.exe
3028	schtasks.exe
2692	schtasks.exe
4172	schtasks.exe
1628	schtasks.exe
1920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe
4472	Windows PowerShell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	Windows PowerShell.exe
Token: SeDebugPrivilege	3496	Part 1.exe
Token: SeDebugPrivilege	3692	Part 3.exe
Token: SeDebugPrivilege	1428	Part 2.exe
Token: SeDebugPrivilege	1588	Part1.exe
Token: SeDebugPrivilege	3252	Part 4.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	3496	Part 1.exe
Token: SeDebugPrivilege	3252	Part 4.exe
Token: SeDebugPrivilege	1588	Part1.exe
Token: SeDebugPrivilege	2180	Part 2.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeDebugPrivilege	3128	Part 2.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe
Token: SeCreatePagefilePrivilege	1816	chrome.exe
Token: SeShutdownPrivilege	1816	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe
1816	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3252	Part 4.exe
3496	Part 1.exe
1588	Part1.exe
1428	Part 2.exe
2180	Part 2.exe
3128	Part 2.exe
3328	Part 2.exe
3952	Part 2.exe
2340	Part 2.exe
1976	Part 2.exe
4848	Part 2.exe
2852	Part 2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1588	5060	ModStickInjectorV1.exe	82
PID 5060 wrote to memory of 1588	5060	ModStickInjectorV1.exe	82
PID 5060 wrote to memory of 952	5060	ModStickInjectorV1.exe	83
PID 5060 wrote to memory of 952	5060	ModStickInjectorV1.exe	83
PID 952 wrote to memory of 3496	952	Part2.exe	84
PID 952 wrote to memory of 3496	952	Part2.exe	84
PID 952 wrote to memory of 1428	952	Part2.exe	85
PID 952 wrote to memory of 1428	952	Part2.exe	85
PID 952 wrote to memory of 1428	952	Part2.exe	85
PID 952 wrote to memory of 3692	952	Part2.exe	86
PID 952 wrote to memory of 3692	952	Part2.exe	86
PID 952 wrote to memory of 3252	952	Part2.exe	87
PID 952 wrote to memory of 3252	952	Part2.exe	87
PID 952 wrote to memory of 4472	952	Part2.exe	88
PID 952 wrote to memory of 4472	952	Part2.exe	88
PID 952 wrote to memory of 4472	952	Part2.exe	88
PID 1588 wrote to memory of 1120	1588	Part1.exe	91
PID 1588 wrote to memory of 1120	1588	Part1.exe	91
PID 3496 wrote to memory of 3984	3496	Part 1.exe	92
PID 3496 wrote to memory of 3984	3496	Part 1.exe	92
PID 3252 wrote to memory of 3416	3252	Part 4.exe	93
PID 3252 wrote to memory of 3416	3252	Part 4.exe	93
PID 3252 wrote to memory of 4452	3252	Part 4.exe	97
PID 3252 wrote to memory of 4452	3252	Part 4.exe	97
PID 1588 wrote to memory of 2864	1588	Part1.exe	98
PID 1588 wrote to memory of 2864	1588	Part1.exe	98
PID 3496 wrote to memory of 4924	3496	Part 1.exe	101
PID 3496 wrote to memory of 4924	3496	Part 1.exe	101
PID 1428 wrote to memory of 3380	1428	Part 2.exe	104
PID 1428 wrote to memory of 3380	1428	Part 2.exe	104
PID 1428 wrote to memory of 3380	1428	Part 2.exe	104
PID 1428 wrote to memory of 4996	1428	Part 2.exe	106
PID 1428 wrote to memory of 4996	1428	Part 2.exe	106
PID 1428 wrote to memory of 4996	1428	Part 2.exe	106
PID 4996 wrote to memory of 3780	4996	cmd.exe	109
PID 4996 wrote to memory of 3780	4996	cmd.exe	109
PID 4996 wrote to memory of 3780	4996	cmd.exe	109
PID 4996 wrote to memory of 4588	4996	cmd.exe	111
PID 4996 wrote to memory of 4588	4996	cmd.exe	111
PID 4996 wrote to memory of 4588	4996	cmd.exe	111
PID 4996 wrote to memory of 2180	4996	cmd.exe	118
PID 4996 wrote to memory of 2180	4996	cmd.exe	118
PID 4996 wrote to memory of 2180	4996	cmd.exe	118
PID 2180 wrote to memory of 3028	2180	Part 2.exe	119
PID 2180 wrote to memory of 3028	2180	Part 2.exe	119
PID 2180 wrote to memory of 3028	2180	Part 2.exe	119
PID 2180 wrote to memory of 1052	2180	Part 2.exe	121
PID 2180 wrote to memory of 1052	2180	Part 2.exe	121
PID 2180 wrote to memory of 1052	2180	Part 2.exe	121
PID 1052 wrote to memory of 4764	1052	cmd.exe	125
PID 1052 wrote to memory of 4764	1052	cmd.exe	125
PID 1052 wrote to memory of 4764	1052	cmd.exe	125
PID 1052 wrote to memory of 4872	1052	cmd.exe	126
PID 1052 wrote to memory of 4872	1052	cmd.exe	126
PID 1052 wrote to memory of 4872	1052	cmd.exe	126
PID 1816 wrote to memory of 2816	1816	chrome.exe	131
PID 1816 wrote to memory of 2816	1816	chrome.exe	131
PID 1816 wrote to memory of 1852	1816	chrome.exe	132
PID 1816 wrote to memory of 1852	1816	chrome.exe	132
PID 1816 wrote to memory of 1852	1816	chrome.exe	132
PID 1816 wrote to memory of 1852	1816	chrome.exe	132
PID 1816 wrote to memory of 1852	1816	chrome.exe	132
PID 1816 wrote to memory of 1852	1816	chrome.exe	132
PID 1816 wrote to memory of 1852	1816	chrome.exe	132

C:\Users\Admin\AppData\Local\Temp\ModStickInjectorV1.exe
"C:\Users\Admin\AppData\Local\Temp\ModStickInjectorV1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\Part1.exe
  "C:\Users\Admin\AppData\Local\Temp\Part1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Part1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Part1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- C:\Users\Admin\AppData\Local\Temp\Part2.exe
  "C:\Users\Admin\AppData\Local\Temp\Part2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\Part 1.exe
    "C:\Users\Admin\AppData\Local\Temp\Part 1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Part 1.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Part 1.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Part 2.exe
    "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DJF0B54Aj7rP.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3780
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2180
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3028
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4PxNlBRxQrDK.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3128
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G8rcDiwkOtyz.bat" "
        8⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:228
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HGE3PL94CTmN.bat" "
        10⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vFHo0MdJ3mI4.bat" "
        12⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        13⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mdjz6MzUx7RR.bat" "
        14⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j18a8LommEW7.bat" "
        16⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4848
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EPfZVT0YU45X.bat" "
        18⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        19⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Part 2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Part 2.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$77STARTUP~MSF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Part 2.exe" /rl HIGHEST /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eZoxupuwx857.bat" "
        20⤵
        
        PID:544
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:4124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 2180
        20⤵
        Program crash
        
        PID:752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1608
        18⤵
        Program crash
        
        PID:3652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 2200
        16⤵
        Program crash
        
        PID:2308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1712
        14⤵
        Program crash
        
        PID:4148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1096
        12⤵
        Program crash
        
        PID:3896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 2252
        10⤵
        Program crash
        
        PID:348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 1740
        8⤵
        Program crash
        
        PID:4196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 2200
        6⤵
        Program crash
        
        PID:2436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 1720
      4⤵
      Program crash
      PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Part 3.exe
    "C:\Users\Admin\AppData\Local\Temp\Part 3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Part 4.exe
    "C:\Users\Admin\AppData\Local\Temp\Part 4.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Part 4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Part 4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Windows PowerShell.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows PowerShell.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 1428
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2180 -ip 2180
1⤵
PID:4056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa4764ab58,0x7ffa4764ab68,0x7ffa4764ab78
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2316 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:8
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:8
  2⤵
  PID:348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=2116,i,17090422337063456703,17128748673048296676,131072 /prefetch:8
  2⤵
  PID:4844

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3128 -ip 3128
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3328 -ip 3328
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3952 -ip 3952
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2340 -ip 2340
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1976 -ip 1976
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4848 -ip 4848
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2852 -ip 2852
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 3349898bf77fe158ee6b426faa521b07bd350c155b7e460e104304e4cb23ca67
MD5 d1bf5407138fd539f355843c11b0bb8b
SHA1 e68590aa2b0a0057af86fde6d7cffcf43d42e19b
SHA512 588b8e31ba4cf2067826bf191b1b41636438765d1f6089ea8f055feffe23a28d28afd060b3c402602f22578e50d37578164e88e5706ba07d0198e14978366d85
SSDEEP 192:hNqpuPZaJLo8syh+F602KXP5tjEsXtScR:hNqcELCyqD2KBtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 313788a8e3ebdaaab43a27808f68ff3b91b04e3f5df4fa6145775f46dd4387a9
MD5 567a11ef5302ef5dd9dce7d50388a9ab
SHA1 71a3e6486da9366142cfdd9a143c9458ea525447
SHA512 af4826c048f8c36d00191e080613a9d11780928126b386ee95796b5977f43df558396111a2b92f58395279e6eb5aef9300ffae010c7ca47f9d2ab6849e727595
SSDEEP 6144:SrI1Qo5yzkpeXjnJFzXsWhQYRPILxZnhLMJjX0EeGzY2rLC:SEjCkpeXtFbNQ5fnReEFsLLC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 b267a1d89f0b00706666b589f19b7dc0a22a83f43071e3b57d2c592f840b8fbb
MD5 ebb92731b76695f5eade4738fb501752
SHA1 75f0e30c0de2bb5efc1e9c4ab32bc886a73f9a16
SHA512 4fb7441406f7ed8705f43ffb55daa7504e5f7ea22f4680dde7d0266d01775204c9044e1be4b71c28b4f0f38712104c4f2c4655a3b9bec3598ecbe7615b92a1b7
SSDEEP 6144:0rI1Qo5yzkpeXjnJFzXsW0QYRPILxZnhLMJjX0EeGzY2rLC:0EjCkpeXtFbwQ5fnReEFsLLC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 92KB
SHA256 b83a4f8759bc0325da15a04fb73e9f4d3ffac51b168feb8f7510b0b8a14a9d5a
MD5 3f27923e8d9934c24fb79ac12028ed19
SHA1 8b91d0f5f468055ebf3458429f5c6dc0e07f17ac
SHA512 2096f28f0f5e5d8b2bc61f2eb1b6a3637a776def3de26a7d0f0a41b2697cf446d5464c511c3c45671445fcf26aa02d1d3ec230aa8922e375f404ec1ae7599ed7
SSDEEP 384:SK52xEQ3iSG6EiV33tnwH0mJp6yD9KEAoivBcz0kmMdHTbL6ruEIu1dzqY8Kz/fd:WiQybasjKk4Lget6KtOBA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5884cb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5884cb.TMP
Size 89KB
SHA256 1045626a6c82e3211c67c34933382cbc9d38eb7aa15ab19a60e1be34feeed633
MD5 d472cf2bdae8afd42feb059b58399197
SHA1 cd24bf94cb1070fac58d29a84c1397425d57dffb
SHA512 e4efd4bd317f524527b1102dd5eb0b0e6115c6f4d01b0d2b59d65c931df62c2b5c6f801dcf5887e8ba4e8548eb8ab7b896bc4f83acd22beb2d76929525e695c2
SSDEEP 384:gK52xEQ3iSG6EiV33tnwH0mJp6yD9KEA3vBcz0kmMdHTbL6ruEIu15qY8Kz/fXwd:MiQyba+jKk4Lget6KtOBb
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e6254c2bc9846a76a4567ab91b6eae76e937307ff9301b65d577ffe6e15fe40a
MD5 47605a4dda32c9dff09a9ca441417339
SHA1 4f68c895c35b0dc36257fc8251e70b968c560b62
SHA512 b6823b6e794a2fe3e4c4ecfb3f0d61a54821de7feb4f9e3e7fd463e7fbb5e6848f59865b487dafebeac431e4f4db81ef56836d94cac67da39852c566ed34a885
MD5 SHA1 SHA512

Submit Download

4PxNlBRxQrDK.bat

Path C:\Users\Admin\AppData\Local\Temp\4PxNlBRxQrDK.bat
Size 203B
SHA256 93c6fd9fd08c60df9d0bd1b065d0cba3f8572333f1da2ba14e102bdc04364883
MD5 645100d2a9ee9533a45086feea188913
SHA1 f9f99022bfa881970c480f30a5a944ac3fcd8479
SHA512 8df1c0625a7d5ddcc1d24c567703cebf507e71b775ef098d0362e0e94af37fc9e79239e07638b2504d9d16a0ce61805ef17227eb64299caf5a390fc9f82fb992
MD5 SHA1 SHA512

Submit Download

DJF0B54Aj7rP.bat

Path C:\Users\Admin\AppData\Local\Temp\DJF0B54Aj7rP.bat
Size 203B
SHA256 3ec4d7238d6b2792366e10215b7e6ac5277ae67071f189e258cf3b1f8a2dba4e
MD5 0e8829e1b466ad56641efcaddb278d47
SHA1 7210a73e6d5dce1c83df9ce9ddda776aa58915e8
SHA512 6e5540b64c74cbe4eb39054343c18b27200673304e18decd9f7eb35a055041658670324ece7677340519da04638e35f07c60d503aeba62459c7690622c151cb0
MD5 SHA1 SHA512

Submit Download

G8rcDiwkOtyz.bat

Path C:\Users\Admin\AppData\Local\Temp\G8rcDiwkOtyz.bat
Size 203B
SHA256 23b5fe26e54b4269416e87e33f49d33bb8f4dcc6370815428910cf4aa900ddaa
MD5 2f1311994e0ae490684b6290adfe3799
SHA1 7ab15f02a512d28ebaa7636105d676f4149705d6
SHA512 feca762bccd4e68a56ced5550173e089897d3b39382f9364b4ed1bbc8dd02c03fd969eb8f6169af395cd0f3a06d89637095a3c307b06fbfef1cde9af393463ab
MD5 SHA1 SHA512

Submit Download

HGE3PL94CTmN.bat

Path C:\Users\Admin\AppData\Local\Temp\HGE3PL94CTmN.bat
Size 203B
SHA256 c316b80679c51ab257722059255f129e1818f12845ddf3df699baf7e37cc602f
MD5 729d8cc4f13ec2fb61e8336a9dfc081a
SHA1 bec35e82bbf6896dd34ac7053319a50327320b5a
SHA512 ca038a4c80cccf4b7c55ef431bdf0d7139d7216ac3fd173cdb8691f4edbe09c6f176d2945f4332698100fdaa8be802a7614b649ed3d17aeb5d0545b82f1db930
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 44B
SHA256 2334ad0b286853b075817b9130e53a6e6bc04431346a6a91aed842ad807f522b
MD5 bbf3ef9f844c7a484b50d54168fe35e3
SHA1 5e98b39e983204e4cbe76f2d64c4b3deef9420ae
SHA512 656934957551bd8451fca1c7e4ea997d4f7795c7fad0c416ff5a274b8ee26973a268114c76c46f9cdbce9dcbc028e8ef82c128656ce6a6ef576855a6706e370a
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 88B
SHA256 2f1d2e6ed1d40c89e8328796a83a190a3c793d9ec4702b7912bc14c7fdce75e4
MD5 18669030a489ec4889e36be9accd68ab
SHA1 06cb675d11ebe96f09dcea1e97dc1944d0e321b1
SHA512 f616597b7fdac4876192e8e141b80df0fd75f892b9d05212b25eef135ca5f3e01b730b7423670751905f050b044e3e81928e3a66a3f765c9e5a4048a7b37ae6f
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 132B
SHA256 96cc4ed62e2171434e429b8756b60052059587db65d4bf7e9dc1e810105a2c82
MD5 ff233f0fd4dad9ba1666849e495b7cfc
SHA1 b1df0e862f58ac6c658a39dfa7cc80b9e679ec0d
SHA512 5063f7798e8e0abcc079ab404f069b41068639066822b95ef4158865cc39c67a666b50918ce64789ca9ce58b5f93e47484f52acba6eba402ac14209cccadd4e6
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 133B
SHA256 f4b441e5965fd64f45c4ca7b7f3dad2d3ae8beff675e7c865d1f85837a13c816
MD5 89a1deaeb74a97072e03b30871fd0d07
SHA1 f245b5b6f4974acf4b4f39261668098136886a41
SHA512 76dab78e5391ca5c32ebd8017f4d2880d1a742712f680052f43fe268f7a024797c71fdfaf4de4bb973594a168e6019412dc53ed519decc785b2821dc1278d05c
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 134B
SHA256 19a75d2822ac3960fe9899ae1eb87cf78c4cbe1f9bcf83aad27a63df20fa72bf
MD5 7e3f1edf4c8a6359d95e116fba06b1ac
SHA1 16f1a4df7762d4bc18298b573c55c58cf90578cb
SHA512 e7ad6921e92e90475490563dd2d6971f5342a2726ea400f70ce0e292de7ab950519166b1e0c9a43dbe4678d460519ae175c652b37856fb1833635a9383efc59a
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 153B
SHA256 99447e405cec2bfed2145cbbb9a1571e79bc9941d55fa60d39c1d53c6eaef0e2
MD5 e099eb1c1fb4717b69a548c6d6f67360
SHA1 5b9a966d17239d5fde48751272ed45e892102306
SHA512 b1e5e71de45cc70ac15ae4ad3aedf660fae2b159ad140474c83e848439b9c26eadcd86cad9a971f3b84dd78aaf7581b928d99cd23ac0a9d4b35b88583619b47e
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 156B
SHA256 46f119871082ad00dc47c50cd68d6e6220e0557611eaf3f86e930982bdf11c16
MD5 11c7bce8650d54aa781455795886dd0b
SHA1 ba2f3cae52d5472864d1aeea06056c267d8f9843
SHA512 125ec3b6f6c5b2125992ec61135bedf0675eaa32ef986078f1b93aad3a3a4ce907dbad825687513305e0ccf91de919479ad036aeb41e038fb8eadb5cb8472369
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 162B
SHA256 eeac7a367b4c819b8818d4af669affad7e61f2070d50906dda680eae5178a5b4
MD5 03443f9d6a6ba6316edbb5b2692faac6
SHA1 16cd9865ef1317202867aeba93976c4fabe49777
SHA512 4fdf9c1e7fe1a745c6bfdedc7dec0a577513e8478c4e0a17bbbfcff1c44ba62fc9be741408c5caf12d1ab3f3db24e38b692efed900d458db1bd750d358533bdc
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 168B
SHA256 1724c6287b6578ab2791f0282d3092f23d76eecb812dfdc9c239efc854c04a94
MD5 f3a6661cfab138a45e29f191cd5a7322
SHA1 a9818fc84948c100ee2dbc17ce2234a591a96306
SHA512 a6ea014c4990a971260d20bb51adc8a7f5eb0042bc5d542bcc9895a7b0c337385a963b9bf2895a3a69babed402c74f96523191c7d0733b6149a1aae11f12f3f0
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 174B
SHA256 4ef48dcfdb13b2714076e770a832052781c3295afe7820e18ccfe88d35de1368
MD5 a19e556bbf1a140199674599835eb5e4
SHA1 4cf117fe24dc2dbcd7f1086d0f64bebcab4fa901
SHA512 b503d925754a76af282d80c21e19f22158d123e6d42ef9cb88e3c78101aa51d2e7c402bcd193cfea32a5b615ffcd5a3b01a285480aa673f66702d6a2ec491ffa
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 175B
SHA256 bf6ca2788950b9b3d434893fccbc464555db2cba27d483baf1db5ef93a08ca97
MD5 5d7cb3fe4953179af0aa3da5d7cd8818
SHA1 3f3f72394f875c44412a05de55fbeb45c9a04bc1
SHA512 88b6dc90bfbc79adf698cb193741ed879dd05920eccecd019eee17a67a9ea1df9a329f121a77d14b51c843076ccb2f40ea50d4729d5f0f6fbc116f2cc33ff410
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 176B
SHA256 ffc5c6e42ba62f17028737222273b85eef071697931f1b9a7364e2b940241787
MD5 2248bea3782aa3dcb0440b243771aa8f
SHA1 3929dc9c3d8b0c4591e718fe2ac45d337f8ae4a3
SHA512 3bfe432069ce777dd81601c15ef2dca7b30f0e754ab409b34285378a04ebc8df382b7173e5d3c57d09daedc8f7fc681b9e7c0b2f671dea6b36d9b186d9d4c983
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 177B
SHA256 adb1d5e1592aa7957c3281aa24067d3ad8c742d5652c93cd04d4fa7c39b026c4
MD5 277aa1c704b82e72251641daef571415
SHA1 bad4500bd443e8716cff9b58b67f366a5e8c7d4e
SHA512 0ef8acb441aebb41a87814020c0899996d0b60ebd74203e90c68968cc58fdc5190fc793a0e2933b3677395f07495befac521900ad351e71247d13cb9cae87e73
MD5 SHA1 SHA512

Submit Download

Mdjz6MzUx7RR.bat

Path C:\Users\Admin\AppData\Local\Temp\Mdjz6MzUx7RR.bat
Size 203B
SHA256 bdcd44f0815a4947598ac28ac0be1b3d87adcc8319e476c15ea04a19970608cb
MD5 3f99227f1dd98be2193d6f2463740e58
SHA1 e205eadb40d0a457dd395c059d46a72481a8431f
SHA512 ae55d2f312e54d15033aac78eb9bb016c7027aea9a22003269763822565e06a2d46bc43bff19a49bb1ef1fb86bb9a2129d452fa7d57c4a25274d61a8baf64561
MD5 SHA1 SHA512

Submit Download

Part 1.exe

Path C:\Users\Admin\AppData\Local\Temp\Part 1.exe
Size 67KB
SHA256 91431cb73305e0f1fdc698907301b6d312a350f667c50765615672e7f10a68f2
MD5 092a0c6fe885844fd74947e64e7fc11e
SHA1 bfe46f64f36f2e927d862a1a787f146ed2c01219
SHA512 022589bd17b46e5486971a59b2517956bb15815266e48dc73a7ae9ac9efd42a348af09df471562eb71ffc94ce1e1845d54ca2994663d1496a385bce50ae595f0
SSDEEP 1536:0dIDrjXx8uoH44gr6bBBr52p62sOPNrP62kT:0darxzzWbBBBOPpWT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Part 2.exe

Path C:\Users\Admin\AppData\Local\Temp\Part 2.exe
Size 409KB
SHA256 021068ac225e479b124c33d9e7582c17fdea6e625b165b79e2c818479d8094e4
MD5 e10c7425705b2bd3214fa96247ee21c4
SHA1 7603536b97ab6337fa023bafcf80579c2b4059e6
SHA512 47e031992d637fef2a67e4fb08d2d82eaba03eba6b80f3e0e0997153acf0d979d0294276c4a10a97daa50130540230865c56191e6fe8df07dbea11c50fa48a2d
SSDEEP 6144:ZMp2pJAJcC0B62a6tjSszde/+FqBYkTbt3VAl4ydlxGEVuOSV2:/pyJcC+Pa6tjSszd4ckl3VYGNOSV2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Part 3.exe

Path C:\Users\Admin\AppData\Local\Temp\Part 3.exe
Size 63KB
SHA256 29e13a91af9b0ac77e9b7f8b0c26e5702f46bd8aea0333ca2d191d1d09c70c5d
MD5 27fe9341167a34f606b800303ac54b1f
SHA1 86373d218b48361bff1c23ddd08b6ab1803a51d0
SHA512 05b83ad544862d9c0cfc2651b2842624cff59fc4f454e0b1a2b36a705b558fad5a834f9f1af9f2626c57f1e3cd9aa400e290eaafb6efeb680422992bcbbde5b0
SSDEEP 1536:H1/ksW8XWpTt4pYUb1h99+MSquwdpqKmY7:H65zpTtCYUb15RGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Part 4.exe

Path C:\Users\Admin\AppData\Local\Temp\Part 4.exe
Size 79KB
SHA256 4834d31394f19d42e8d2a035b4c3c9c36441340ea19fe766396848ecfb608960
MD5 1f1b23752df3d29e7604ba52aea85862
SHA1 bb582c6cf022098b171c4c9c7318a51de29ebcf4
SHA512 d52722ab73bb15d4a5b0033351f98f168192f382677e6d474f6cf506cf8dc2f5e421e45279b6cac0f074857f41a865d87b5d989450bfcb8eba925b7baa12fbde
SSDEEP 1536:xeUhECxO8dK+EaAljQUD9Pw0aOApug28itb/mGQOvu69lZkkq6pOCM0GJSB9:xNxO8d5x05AitbuAve5qOCMcH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Part1.exe

Path C:\Users\Admin\AppData\Local\Temp\Part1.exe
Size 74KB
SHA256 ecb87965ad5fdc76a30721226b1cb8a6263bbbce476a0446ff730b6399022998
MD5 e35a7249966beef31a45272c53e06727
SHA1 cc54648f9c9423f7a625e96256c608791b1ab275
SHA512 1dc30dc4a690aa87211db37b8fbc152e2e9e2b2554927296ff62bd4d2a7ab542777faaa4752399719cfe816cf3886b3bb4a90539f3f197dedd52298f2a315114
SSDEEP 1536:B9ih15W6+z5bgoiOmrdxgrkFPxrbHG6Wk7YF6J6DCm4oOL3f:Xh5Jq7gr4PxrbHGm7Y6u4oOLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Part2.exe

Path C:\Users\Admin\AppData\Local\Temp\Part2.exe
Size 661KB
SHA256 429c5dd3f4af9dcaa0ebaefda12281af7c84b3e3aa05d1034ddf89d2bdefb720
MD5 c47c0d681b491091209c54147c33da81
SHA1 58cb51be41aa576ce56d4c16c9c443e70e648f62
SHA512 f3a6f9af783910dd94622bb0408385228dfe322487d9d89c140e2e49b8abbc3b9c9f3cb580635166d1ddf6f5b7feeac51380044cf100476d6994adc7cac6cc5c
SSDEEP 12288:iM0//MBG/ZG+GuYU4utDBYlX+lDcDdkJ08XQUgVgmFsXIo:WEuZQU4o9Ysla6ikIV4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows PowerShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Windows PowerShell.exe
Size 27KB
SHA256 25510f3aa1b879ea92a3cba9583d73e447b8765bae6dfcc4954bb72df5beaa7f
MD5 4daae2de5a31125d02b057c1ff18d58f
SHA1 e1d603edfcc150a4718e2916ae3dda3aa9548dc8
SHA512 7cda96a69f9cddab307f3f08e1f38a4d059f0cc7f7119d4a48891efdb01cf101ebcc06cb2ce0702ea2d689d27ee45faddc0a13cd72503c609c4e544919549a2a
SSDEEP 768:kksDbSzyRC6YMba5gSUW4nk7SkqQhte9rsz:8XCAba5gSUJk7bhhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ywex4h5o.0fv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ywex4h5o.0fv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

vFHo0MdJ3mI4.bat

Path C:\Users\Admin\AppData\Local\Temp\vFHo0MdJ3mI4.bat
Size 203B
SHA256 53629bb941795e33b80d07ca7e42de9c0e207b1eff9183b09d4382a6383c5425
MD5 0964c86f88b2615015c29983f87795d2
SHA1 005e511031940ff5e3e34e5107b28b6648cb653e
SHA512 00928ea09ed3bbd9ea944e9dc5c94f046aac0742ec9b859e05ee4fa78cdf93237602d7e0c295ee22db13b86468a12e2a648f94c0a9c750f17f62896c8c49fdf0
MD5 SHA1 SHA512

Submit Download

06-27-2024

Path C:\Users\Admin\AppData\Roaming\Logs\06-27-2024
Size 224B
SHA256 ab40ae5a2a6151ecfd523df73b2bddf4b3251e267d80d983b8bdd644374df0d4
MD5 ebefa78d10b055c099f75191554e37e4
SHA1 f5a3263620daead70e0f616d51fe111356c491a5
SHA512 6087b638a421f8f2b7e3611a2477955d7e78f63af7a0ac2baea9043e396e667d89c0b5d18f47f649fb2ff375dfa26feaa828105a471dcd1f50dfe3ff56156c99
MD5 SHA1 SHA512

Submit Download

06-27-2024

Path C:\Users\Admin\AppData\Roaming\Logs\06-27-2024
Size 224B
SHA256 faabf4f0e71ae1013754dbd31e798264dde6f5376a715c79c088372fd3eefbb5
MD5 33d1b74da7f0614bba948518587ea394
SHA1 dcf8b50b85c12fc80647759929c5e0b3108bd413
SHA512 b25e1ce4f632a99d28ec18afaf47732b44180b4f7f63e0d2a60503b779dbff576e70134e98c1b616250815f3569a13880551370e02dc167a9213e19812b4570f
MD5 SHA1 SHA512

Submit Download

memory/952-26-0x0000000000920000-0x00000000009CC000-memory.dmp

Download

memory/952-89-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/952-46-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/1428-86-0x0000000000FC0000-0x000000000102C000-memory.dmp

Download

memory/1428-91-0x0000000005910000-0x00000000059A2000-memory.dmp

Download

memory/1428-95-0x00000000059B0000-0x0000000005A16000-memory.dmp

Download

memory/1428-96-0x0000000005E50000-0x0000000005E62000-memory.dmp

Download

memory/1428-88-0x0000000005EC0000-0x0000000006464000-memory.dmp

Download

memory/1428-169-0x00000000070F0000-0x00000000070FA000-memory.dmp

Download

memory/1588-97-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/1588-167-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/1588-166-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/1588-28-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

Download

memory/1588-24-0x0000000000690000-0x00000000006A8000-memory.dmp

Download

memory/3252-87-0x00000000006E0000-0x00000000006FA000-memory.dmp

Download

memory/3416-104-0x000001D9F27B0000-0x000001D9F27D2000-memory.dmp

Download

memory/3496-70-0x0000000000860000-0x0000000000878000-memory.dmp

Download

memory/3692-81-0x0000000000560000-0x0000000000576000-memory.dmp

Download

memory/4472-92-0x0000000000100000-0x000000000010E000-memory.dmp

Download

memory/4472-93-0x0000000000A80000-0x0000000000A90000-memory.dmp

Download

memory/5060-1-0x0000000000D10000-0x0000000000DD2000-memory.dmp

Download

memory/5060-0-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

Download