4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6

Analysis

max time kernel
150s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Size

257KB
MD5

cd61032ae7bcdd087a60824958f966a0
SHA1

144aa2d9732ccd1c3a71833dbc30cd975e84c6d6
SHA256

4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6
SHA512

211318757eff85e63cde3cde723b790abce8af1e8b8712acc5569281f925aeca04b3076ada55a0287b1655d68a5ef1c511978be824ba54a148c645d7500df38d
SSDEEP

3072:Og9OBT3Be2Q6khQiCCuefXxzk6iGcbPChEdGZFR2obD4CTvek5WNQp0qYutgxbaA:UeC4EwZFoobUk8qp0qpgqOZ

Score

10^/10

evasion execution trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ewzrptcq.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ewzrptcq.bat
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ewzrptcq.bat

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	ewzrptcq.bat

Executes dropped EXE 1 IoCs

pid	Process
4012	ewzrptcq.bat

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	ewzrptcq.bat

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	api.ipify.org
24	api.ipify.org

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3864	sc.exe
4460	sc.exe
2144	sc.exe
1088	sc.exe
2784	sc.exe
464	sc.exe
1988	sc.exe
2440	sc.exe
4412	sc.exe
3884	sc.exe
2992	sc.exe
1428	sc.exe
1588	sc.exe
1036	sc.exe
2516	sc.exe
1712	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3672	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat
4012	ewzrptcq.bat

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
Token: SeDebugPrivilege	4012	ewzrptcq.bat
Token: SeSecurityPrivilege	4332	wevtutil.exe
Token: SeBackupPrivilege	4332	wevtutil.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3864	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	83
PID 1376 wrote to memory of 3864	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	83
PID 1376 wrote to memory of 1036	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	84
PID 1376 wrote to memory of 1036	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	84
PID 1376 wrote to memory of 1336	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	89
PID 1376 wrote to memory of 1336	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	89
PID 1376 wrote to memory of 4460	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	91
PID 1376 wrote to memory of 4460	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	91
PID 1336 wrote to memory of 1712	1336	cmd.exe	93
PID 1336 wrote to memory of 1712	1336	cmd.exe	93
PID 1376 wrote to memory of 4012	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	95
PID 1376 wrote to memory of 4012	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	95
PID 1376 wrote to memory of 4568	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	96
PID 1376 wrote to memory of 4568	1376	4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe	96
PID 4568 wrote to memory of 4396	4568	cmd.exe	98
PID 4568 wrote to memory of 4396	4568	cmd.exe	98
PID 4012 wrote to memory of 2516	4012	ewzrptcq.bat	99
PID 4012 wrote to memory of 2516	4012	ewzrptcq.bat	99
PID 4012 wrote to memory of 1988	4012	ewzrptcq.bat	100
PID 4012 wrote to memory of 1988	4012	ewzrptcq.bat	100
PID 4568 wrote to memory of 1200	4568	cmd.exe	103
PID 4568 wrote to memory of 1200	4568	cmd.exe	103
PID 4568 wrote to memory of 3672	4568	cmd.exe	104
PID 4568 wrote to memory of 3672	4568	cmd.exe	104
PID 4012 wrote to memory of 4928	4012	ewzrptcq.bat	105
PID 4012 wrote to memory of 4928	4012	ewzrptcq.bat	105
PID 4012 wrote to memory of 2144	4012	ewzrptcq.bat	107
PID 4012 wrote to memory of 2144	4012	ewzrptcq.bat	107
PID 4928 wrote to memory of 1088	4928	cmd.exe	109
PID 4928 wrote to memory of 1088	4928	cmd.exe	109
PID 4568 wrote to memory of 4812	4568	cmd.exe	111
PID 4568 wrote to memory of 4812	4568	cmd.exe	111
PID 4568 wrote to memory of 4332	4568	cmd.exe	112
PID 4568 wrote to memory of 4332	4568	cmd.exe	112
PID 4012 wrote to memory of 396	4012	ewzrptcq.bat	113
PID 4012 wrote to memory of 396	4012	ewzrptcq.bat	113
PID 4012 wrote to memory of 2440	4012	ewzrptcq.bat	115
PID 4012 wrote to memory of 2440	4012	ewzrptcq.bat	115
PID 4012 wrote to memory of 1992	4012	ewzrptcq.bat	117
PID 4012 wrote to memory of 1992	4012	ewzrptcq.bat	117
PID 396 wrote to memory of 464	396	cmd.exe	119
PID 396 wrote to memory of 464	396	cmd.exe	119
PID 1992 wrote to memory of 2784	1992	cmd.exe	120
PID 1992 wrote to memory of 2784	1992	cmd.exe	120
PID 4012 wrote to memory of 4412	4012	ewzrptcq.bat	121
PID 4012 wrote to memory of 4412	4012	ewzrptcq.bat	121
PID 4012 wrote to memory of 3352	4012	ewzrptcq.bat	123
PID 4012 wrote to memory of 3352	4012	ewzrptcq.bat	123
PID 3352 wrote to memory of 3884	3352	cmd.exe	125
PID 3352 wrote to memory of 3884	3352	cmd.exe	125
PID 4012 wrote to memory of 1516	4012	ewzrptcq.bat	126
PID 4012 wrote to memory of 1516	4012	ewzrptcq.bat	126
PID 1516 wrote to memory of 2992	1516	cmd.exe	128
PID 1516 wrote to memory of 2992	1516	cmd.exe	128
PID 4568 wrote to memory of 428	4568	cmd.exe	129
PID 4568 wrote to memory of 428	4568	cmd.exe	129
PID 4012 wrote to memory of 2088	4012	ewzrptcq.bat	130
PID 4012 wrote to memory of 2088	4012	ewzrptcq.bat	130
PID 4012 wrote to memory of 1684	4012	ewzrptcq.bat	132
PID 4012 wrote to memory of 1684	4012	ewzrptcq.bat	132
PID 4012 wrote to memory of 3520	4012	ewzrptcq.bat	134
PID 4012 wrote to memory of 3520	4012	ewzrptcq.bat	134
PID 4012 wrote to memory of 4444	4012	ewzrptcq.bat	136
PID 4012 wrote to memory of 4444	4012	ewzrptcq.bat	136

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4396	attrib.exe
4812	attrib.exe
428	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe
"C:\Users\Admin\AppData\Local\Temp\4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Windows security modification
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3864
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wdfilter start=disabled
  2⤵
  - Launches sc.exe
  PID:1036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\sc.exe
    sc stop wdfilter
    3⤵
    - Launches sc.exe
    PID:1712
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start=disabled
  2⤵
  - Launches sc.exe
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\ewzrptcq.bat
  "C:\Users\Admin\AppData\Local\Temp\ewzrptcq.bat" ok
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config wdfilter start=disabled
    3⤵
    - Launches sc.exe
    PID:2516
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WerSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:1988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:1088
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:2144
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WerSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\system32\sc.exe
      sc stop WerSvc
      4⤵
      Launches sc.exe
      PID:464
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config WdNisSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2440
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:2784
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config XblGameSave start=disabled
    3⤵
    - Launches sc.exe
    PID:4412
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\system32\sc.exe
      sc stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:3884
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop XblGameSave
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\system32\sc.exe
      sc stop XblGameSave
      4⤵
      Launches sc.exe
      PID:2992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "XXXXX" -AppPathNameMatchCondition "C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "YYYYY" -AppPathNameMatchCondition "C:\Program Files (x86)\Common Files\BattlEye\BEService.exe" -ThrottleRateActionBitsPerSecond 8
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
    3⤵
    PID:3520
  - - C:\Windows\system32\sc.exe
      sc stop wdfilter
      4⤵
      Launches sc.exe
      PID:1428
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop faceit
    3⤵
    PID:4444
  - - C:\Windows\system32\sc.exe
      sc stop faceit
      4⤵
      Launches sc.exe
      PID:1588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5788cd74-3638-420e-a6cf-7ddbd5ffd558.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe"
    3⤵
    - Views/modifies file attributes
    PID:4396
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "HiberbootEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1200
- - C:\Windows\system32\timeout.exe
    timeout /T 1
    3⤵
    - Delays execution with timeout.exe
    PID:3672
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\4f0ba9092f3cb4cdd6dce1063c63be405148f5b9713a00a450cee684258f71c6N.exe"
    3⤵
    - Views/modifies file attributes
    PID:4812
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\5788cd74-3638-420e-a6cf-7ddbd5ffd558.bat"
    3⤵
    - Views/modifies file attributes
    PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
d8cb9759be15a8f0f56376ca3479d293

SHA1
42c782cd5972ea8242691daa05425ac3aaa8844a

SHA256
0020842f7ad31c8d553933da597c96a958e418abfeee2e0a9c8e16c51f9d2ba7

SHA512
62a1411f9f8ba4387f12e6d469ca8ab321ff81d8c8489e9fcd8125a0b8e6a63300dc5a872d692d194fb272f6b43f638eb3e05a0af72399d0c9ca0bd1b40ff4bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5788cd74-3638-420e-a6cf-7ddbd5ffd558.bat

Filesize
780B

MD5
17453e405fccbb8f049460ece83923c9

SHA1
3584411cc63c76756a4c471eba89d9ba69b9b554

SHA256
3dd93c13a7ec499b3ede9df3984f4cd0bc2b8711e6148691033b5c99e7a07df0

SHA512
e24aa14a4790c644fcec9cad55619c5bc8c84300efec978027e56fb303549dc2d893d8620c96febd0962a69486acce2e85ce7bc0d9b07873256a507186a8b23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ccohzoqc.asp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewzrptcq.bat

Filesize
258KB

MD5
04cb3fefd28fcf88575ed347898380f6

SHA1
a04c40de3f8d7ed4fa472117cba888b6c24ed89a

SHA256
400adb7cf21b22d1e963f78018d4b7af6a2a460ccdab01e1ed969c0ba665aa0c

SHA512
01b944331d3e0531ce684ee1b69c3a25e64ca345963718c5e35cf26a463d8d41a0cd2319db385c3b79f6910922b332f8964d0365f773823eeb49b049dac1e22f

Download Submit
C:\Users\Admin\AppData\Roaming\spf\unknown.log

Filesize
271B

MD5
228dc90bca74a39c7a86b4a85e2b31f4

SHA1
af48188532b4fd4ace6e8dce5303807977f2ad64

SHA256
73dc3864eab5ec4faa924ac7f782834578f2d7703494d205930c634f1c3a9513

SHA512
0ba9f79eed6f206bec0e9efea1ce2fee9a0ee7b3d53c128eee97be682c0320b7bb762cd6f80c8279a6605590bc31c402161b8baae7da423d0081441c7c9dad5a

Download Submit
memory/1376-16-0x00007FFA73F00000-0x00007FFA749C1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-0-0x00007FFA73F03000-0x00007FFA73F05000-memory.dmp

Filesize
8KB

Download
memory/1376-2-0x00007FFA73F00000-0x00007FFA749C1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-1-0x000002BD04190000-0x000002BD041CE000-memory.dmp

Filesize
248KB

Download
memory/2088-28-0x0000019F516B0000-0x0000019F516D2000-memory.dmp

Filesize
136KB

Download
memory/4012-49-0x0000022BF6B00000-0x0000022BF6CA9000-memory.dmp

Filesize
1.7MB

Download
memory/4012-52-0x0000022BF6B00000-0x0000022BF6CA9000-memory.dmp

Filesize
1.7MB

Download