asyncrat | edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e

Analysis

max time kernel
110s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe
Size 2.6MB
Sample241114-dv4leaxmhm
SHA256 edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e
MD5 e8285f01dff90fca4b37d4df7da03c4b
SHA1 fb19156b1aab033ed8b5212821a8b039a2c363d9
SHA512 f39a69d1c546adb1ba1b744d02bc6407e36c51396d825c03957b584ac22ce1a0b21846a9181e57cb186d34d40cb32bed2662e0bf2caca1bd99f74ee457154a0d
SSDEEP 49152:862EA6E97H+leX14OKwpGpKqYygbN3+3+C+m32sBHEAdpvQKQKd719O03WMl:862nJIO14OKT12Out22sBHXIKQe7e0x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat stormkitty venomrat discovery rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/memory/736-638-0x0000000000A30000-0x0000000000C7C000-memory.dmp	family_stormkitty
behavioral2/memory/4512-653-0x0000000000B60000-0x0000000000DAC000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2472 created 3632	2472	Tracks.pif	56
PID 2472 created 3632	2472	Tracks.pif	56

VenomRAT 2 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral2/memory/736-638-0x0000000000A30000-0x0000000000C7C000-memory.dmp	VenomRAT
behavioral2/memory/4512-653-0x0000000000B60000-0x0000000000DAC000-memory.dmp	VenomRAT

Venomrat family
venomrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoCraft.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoCraft.url	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2472	Tracks.pif
3720	winservices.exe
2908	winservices.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2148	tasklist.exe
1580	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BarryInk	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe
File opened for modification	C:\Windows\SrReduction	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe
File opened for modification	C:\Windows\LunchLeaf	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe
File opened for modification	C:\Windows\WizardHighlighted	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tracks.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winservices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winservices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2468	cmd.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1368	timeout.exe
3856	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3716	schtasks.exe
3096	schtasks.exe
3184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
736	MSBuild.exe
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif
4512	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	tasklist.exe
Token: SeDebugPrivilege	1580	tasklist.exe
Token: SeDebugPrivilege	736	MSBuild.exe
Token: SeDebugPrivilege	4512	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2472	Tracks.pif
2472	Tracks.pif
2472	Tracks.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2320	1880	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe	86
PID 1880 wrote to memory of 2320	1880	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe	86
PID 1880 wrote to memory of 2320	1880	edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe	86
PID 2320 wrote to memory of 2148	2320	cmd.exe	90
PID 2320 wrote to memory of 2148	2320	cmd.exe	90
PID 2320 wrote to memory of 2148	2320	cmd.exe	90
PID 2320 wrote to memory of 5116	2320	cmd.exe	91
PID 2320 wrote to memory of 5116	2320	cmd.exe	91
PID 2320 wrote to memory of 5116	2320	cmd.exe	91
PID 2320 wrote to memory of 1580	2320	cmd.exe	93
PID 2320 wrote to memory of 1580	2320	cmd.exe	93
PID 2320 wrote to memory of 1580	2320	cmd.exe	93
PID 2320 wrote to memory of 3472	2320	cmd.exe	94
PID 2320 wrote to memory of 3472	2320	cmd.exe	94
PID 2320 wrote to memory of 3472	2320	cmd.exe	94
PID 2320 wrote to memory of 4544	2320	cmd.exe	96
PID 2320 wrote to memory of 4544	2320	cmd.exe	96
PID 2320 wrote to memory of 4544	2320	cmd.exe	96
PID 2320 wrote to memory of 4988	2320	cmd.exe	97
PID 2320 wrote to memory of 4988	2320	cmd.exe	97
PID 2320 wrote to memory of 4988	2320	cmd.exe	97
PID 2320 wrote to memory of 2468	2320	cmd.exe	98
PID 2320 wrote to memory of 2468	2320	cmd.exe	98
PID 2320 wrote to memory of 2468	2320	cmd.exe	98
PID 2320 wrote to memory of 2472	2320	cmd.exe	99
PID 2320 wrote to memory of 2472	2320	cmd.exe	99
PID 2320 wrote to memory of 2472	2320	cmd.exe	99
PID 2320 wrote to memory of 1948	2320	cmd.exe	100
PID 2320 wrote to memory of 1948	2320	cmd.exe	100
PID 2320 wrote to memory of 1948	2320	cmd.exe	100
PID 2472 wrote to memory of 1028	2472	Tracks.pif	101
PID 2472 wrote to memory of 1028	2472	Tracks.pif	101
PID 2472 wrote to memory of 1028	2472	Tracks.pif	101
PID 2472 wrote to memory of 1840	2472	Tracks.pif	103
PID 2472 wrote to memory of 1840	2472	Tracks.pif	103
PID 2472 wrote to memory of 1840	2472	Tracks.pif	103
PID 1028 wrote to memory of 3716	1028	cmd.exe	105
PID 1028 wrote to memory of 3716	1028	cmd.exe	105
PID 1028 wrote to memory of 3716	1028	cmd.exe	105
PID 2472 wrote to memory of 736	2472	Tracks.pif	115
PID 2472 wrote to memory of 736	2472	Tracks.pif	115
PID 2472 wrote to memory of 736	2472	Tracks.pif	115
PID 2472 wrote to memory of 736	2472	Tracks.pif	115
PID 2472 wrote to memory of 736	2472	Tracks.pif	115
PID 736 wrote to memory of 872	736	MSBuild.exe	117
PID 736 wrote to memory of 872	736	MSBuild.exe	117
PID 736 wrote to memory of 872	736	MSBuild.exe	117
PID 736 wrote to memory of 4968	736	MSBuild.exe	119
PID 736 wrote to memory of 4968	736	MSBuild.exe	119
PID 736 wrote to memory of 4968	736	MSBuild.exe	119
PID 4968 wrote to memory of 1368	4968	cmd.exe	121
PID 4968 wrote to memory of 1368	4968	cmd.exe	121
PID 4968 wrote to memory of 1368	4968	cmd.exe	121
PID 872 wrote to memory of 3096	872	cmd.exe	122
PID 872 wrote to memory of 3096	872	cmd.exe	122
PID 872 wrote to memory of 3096	872	cmd.exe	122
PID 4968 wrote to memory of 3720	4968	cmd.exe	123
PID 4968 wrote to memory of 3720	4968	cmd.exe	123
PID 4968 wrote to memory of 3720	4968	cmd.exe	123
PID 2472 wrote to memory of 4512	2472	Tracks.pif	125
PID 2472 wrote to memory of 4512	2472	Tracks.pif	125
PID 2472 wrote to memory of 4512	2472	Tracks.pif	125
PID 2472 wrote to memory of 4512	2472	Tracks.pif	125
PID 2472 wrote to memory of 4512	2472	Tracks.pif	125

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3632
- C:\Users\Admin\AppData\Local\Temp\edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe
  "C:\Users\Admin\AppData\Local\Temp\edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Swing Swing.cmd & Swing.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2148
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5116
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1580
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3472
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 186040
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "toolkitczechhappenwestminster" Texture
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Junk + ..\Screenshot + ..\Colombia + ..\Escorts + ..\Waiver + ..\Aboriginal + ..\Wherever + ..\Higher + ..\Amazon + ..\Releases + ..\Dame + ..\Economic + ..\Innovations + ..\Sampling + ..\Nuke + ..\Fellowship + ..\Brain + ..\Eat + ..\Shopping + ..\Constitution + ..\Planes + ..\Railroad + ..\Enhancing + ..\Locator + ..\Occasion + ..\Pay + ..\Cinema L
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\186040\Tracks.pif
      Tracks.pif L
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:736
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "winservices" /tr '"C:\Users\Admin\AppData\Roaming\winservices.exe"' & exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "winservices" /tr '"C:\Users\Admin\AppData\Roaming\winservices.exe"'
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3096
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6FEB.tmp.bat""
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1368
        
        C:\Users\Admin\AppData\Roaming\winservices.exe
        
        "C:\Users\Admin\AppData\Roaming\winservices.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3720
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "winservices" /tr '"C:\Users\Admin\AppData\Roaming\winservices.exe"' & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "winservices" /tr '"C:\Users\Admin\AppData\Roaming\winservices.exe"'
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3184
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp715E.tmp.bat""
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3856
        
        C:\Users\Admin\AppData\Roaming\winservices.exe
        
        "C:\Users\Admin\AppData\Roaming\winservices.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2908
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Involvement" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EchoArtisan Technologies\EchoCraft.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Involvement" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EchoArtisan Technologies\EchoCraft.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\EchoArtisan Technologies\EchoCraft.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoCraft.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSBuild.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
Size 942B
SHA256 eb1d1fa6b376f369681435d4e310dc2e6e832877a6e2880640727f9390559614
MD5 08fd55ab7b211d3fba9ba080bb93fc07
SHA1 3519a855c1d90857159c68422848785d68a89591
SHA512 61c362ac9ac9809532be0383eb239e06290b1387bc6e49e0ab0045bd7e4b904032f8def000d4b1e4800b6387c193f4ab78f8c507138030490014104cecb726d7
MD5 SHA1 SHA512

Submit Download

winservices.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\winservices.exe.log
Size 841B
SHA256 ff981780f37479af6a428dd121eef68cf6e0b471ae92f080893a55320cc993f7
MD5 0efd0cfcc86075d96e951890baf0fa87
SHA1 6e98c66d43aa3f01b2395048e754d69b7386b511
SHA512 4e79f5a8494aac94f98af8dbbc71bdd0a57b02103757ad970da7e7d4e6a0dc5015ca008256a6bd2c5bdec3a0f5736a994e17b3ef004b0f374a3339e480ac41b1
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\186040\L
Size 2.0MB
SHA256 e87ac417d2ef91b903903033c9aeff31df705c977c14485d6453f6a094a01375
MD5 b9586122bdf0187cf4764ab1094d86b6
SHA1 14d3cdd0350ded70287f5231194bac85f90f0941
SHA512 98f274907f71e9a7358ae53a367ce9c59b73b102ae434c5d3afbf9a48a60d52b48136bb1f8a7e5f1e0ce74f68ac9e1d527a1cf6cebe2dc973570cac1acf272e9
SSDEEP 49152:PCIz48D6Y/TPx1WGEpZOGk7kcLKXoSpeFHDhJrQJEV:PXD6CEp3k7kcLJSpmhzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tracks.pif

Path C:\Users\Admin\AppData\Local\Temp\186040\Tracks.pif
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aboriginal

Path C:\Users\Admin\AppData\Local\Temp\Aboriginal
Size 77KB
SHA256 a749362cd7db4197b678abb7966888748f560d62ba4cc1de6423c5bc7c006794
MD5 7ab5890b2c3d1005c28c835cb3028e24
SHA1 192566f40c73bf626827202702498c26c5edfcda
SHA512 5f1993bb56e75752946557abeb07d6f4e02cd508facd4dafa9e1bedcbdf4807635d55e87fe2889b913c42c38d51b223ef7b8ea118f91633c307521f38bb17569
SSDEEP 1536:AaQvNA2sEzL/qR5C3Zo/gmOKG4+99vNfb5Fy/vollu5faYg7zfuG:AaoNfPqRE3+/gmLGV9LFo/volyCfb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon

Path C:\Users\Admin\AppData\Local\Temp\Amazon
Size 98KB
SHA256 8d74444489acb94aa0ce525f04b3a8dc6af5748afc9fca0b9a70102b86950036
MD5 eb647ff6dc919549935f3cbe209dabb6
SHA1 d06a5e76c060b18ffa920e871b609464457772e6
SHA512 3493ad2670b0f698de3258a885e14fb04b3d651232a85f561de683ac5283ae42d6801110447623779942d4b5fbfa4d058403d50ce5caa7460f321f2b915294c5
SSDEEP 1536:1A73zounabgkyN7E/vejJdUCZOVSfxyIQ0KMpXYFFVJocWI+u0BxzDiki8XEQGu:G3zGcHy/srp1np6FXSdQMGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Brain

Path C:\Users\Admin\AppData\Local\Temp\Brain
Size 93KB
SHA256 f53808fb75ca0103b87a4ad30e493ecf6504744e52a92a55b255a0d5b648f1c8
MD5 2d9e36c8c1b9f4c37d96fd5ed70c30cd
SHA1 62fc604b58e51fbe1b7cf5185779ab645c5ae73c
SHA512 2487ec445644a03cfd51f292d7bdd3635c82563042e1583a68a8440a6fbc09342f052abddefefff9112839b54c07c3342eefc4c980e621e2f970a3e0b09d2ebd
SSDEEP 1536:tgEoyRVsraGJVXj7s4CwzxcUz2+oQ4RfZigYDHIcJoz4px3qwbGla4MQw6WH0dc:SCRVsmKw4CA2+ojfZMzIcJoQqwil2FX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cinema

Path C:\Users\Admin\AppData\Local\Temp\Cinema
Size 18KB
SHA256 49ab2cf269c14e143486c63e1c92731e856ff14dd1f64349bbe8dbf6c7e3bc96
MD5 5fff72d3b82f077572e01ef4beb21888
SHA1 fa14a33f0b04b9126e29431fad8c4494acc145ea
SHA512 dc94a9988a850170d2c860a018734b801821c193f3e1b87dc33d3f30013e462298318b701a763b686bf83cadf65a5f372871557b48d9d17d946dc9dceaa4fe50
SSDEEP 384:DkHmgROQgqzrzXku7yQxXb+CUUxyq/7Q8V6PsQLQPkBBP4gh9:ImxQL0u5L+CjxyivkPsb4Bw29
MD5 SHA1 SHA512 SSDEEP

Submit Download

Colombia

Path C:\Users\Admin\AppData\Local\Temp\Colombia
Size 88KB
SHA256 1dfa978e54ccdaed1552afa966477d98110b5fb1926cfed050ca2513528beae3
MD5 6515719027cc1f2ed807ed0a3f3f8c0c
SHA1 3c962d8600b593d3f9b8058e978ddb76a251e176
SHA512 9d7db5fbc727fef6520017934b0a9bff79ad8b32e4e97af1653a7d1f25bdd6ca670ff985393feda35d01c5b097ca607b33983622389600b48b3aad3eff7cc97c
SSDEEP 1536:QSOq3w/yKp2+b+lF6PGDxY0sD00xCWpXxaM5DR/TLk/AaFUjK7BySauFcJCrkRg:QSOFE6DH0sAWp1qVUj8ZalCrCg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Constitution

Path C:\Users\Admin\AppData\Local\Temp\Constitution
Size 65KB
SHA256 f12de7f6c53ea7304e2110113063e930c22d991e386fc8dc5d7218ba7e922de9
MD5 de8e529c939f257f5fb44f918df40a27
SHA1 99a214cb643fbce8e2fa066620f71a92a2b6a48c
SHA512 87de0edeb63963f9332174555f3edd499c6d47118682be6dc27aa7cc84b94dbd833992bb2ff7beda0d5e59f2d3feffc21b79cd92c83d15fbb52faed6571fecaa
SSDEEP 1536:bJCTCcGinHu0Ci/oMMoQXhMS1MkcnE9tXTzVq5:tGCcGiHu0CRMMafrKq5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dame

Path C:\Users\Admin\AppData\Local\Temp\Dame
Size 64KB
SHA256 804d9cba05bde7fadb13557d754c0b4a94f1304796d7f1184d6b2945d5468428
MD5 b60a210a563020f6b385e5d9d2a5d48a
SHA1 12c5ff09e31223125cf07d7e07493675f37abb77
SHA512 eed1b684a95144badd207c32ce06993f7063b16ba4fb68d3d2d70567938f408cfa143ae3d09440986064bc060a80c32331f86cd300b6be83648c6f97071a94b8
SSDEEP 1536:4/o/On3TwWKqsJaOq540zemWCuOMu+1PGBE0VK+NCgJ3v:go/OnDwWKqsJC4GemWCzMuSeBhKACgJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eat

Path C:\Users\Admin\AppData\Local\Temp\Eat
Size 99KB
SHA256 52535fd7b193b6af02ec9bab6a9b1ba4c732dce8b7752df63fc5e843bd6d42ca
MD5 566b1c377acc552cd1dfccac12b76864
SHA1 be3c712fb4fab2f8e1e2c8501e3f98a4b0c9eba8
SHA512 684fdfe65c74c6d874bd8100a862183c68ccea76aff99f0c14aaf6b0689661fe35570411f4325db60f3234221cb51df58290baef1a6708d48c3069c34ccf8d39
SSDEEP 1536:u9tHZqOaEzfoBR8BPx+TmUVovXLwwnZf73DwC3VNxTETaNUb1RzSLktG5:u7clzrkx+TmiovbjZf7XVNx8be0u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Economic

Path C:\Users\Admin\AppData\Local\Temp\Economic
Size 73KB
SHA256 e5f2629af661686dfd66803c2e56e150edd1058fb0d56042bd19c989f45bc4b4
MD5 5f7388b9727596fb03ae3d82e7f7d896
SHA1 bf516f10cd9e29e8820ac1e3a52649842b2dbd9a
SHA512 cb5cf2c053a7f712e165d184d57bf9c5495a9b99ab8354083966027ee155fd210596cb2378a906836a23f03131a58f04119dcf96a0c14a2fe25f2debe5d8508f
SSDEEP 1536:do997qzMGyAQX7jHbB5JKlyoU3dMYC4+fTX3Oc0Zrr0nWFPQ:W97q/07BGla/L+T39Wf0nMQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Enhancing

Path C:\Users\Admin\AppData\Local\Temp\Enhancing
Size 99KB
SHA256 4d8187a53d6fc2b4eb6d5c78f30980b953cf11e91279b1c5ac09d780142a9970
MD5 2b92b119cce7513b80c8f0851c286638
SHA1 ea7dad1f6590119d5b07d4d76c61e111b8921dfe
SHA512 dc2d1b0ea28986c38afe09048412d21c990e557054f700eddc9c642a0f7cc6d1d9052dec554b3e8240c61d1071d2deeb5ef69872926b4e237fc0093fe3fed615
SSDEEP 3072:udZouH0hLrKvxdAtYRYVvlBVbz0jUVgINvyVeO:OghkxwVvlPzzVgINvxO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Escorts

Path C:\Users\Admin\AppData\Local\Temp\Escorts
Size 77KB
SHA256 10d58246c582fef665f213d47a85974e1d7e75ecfcddf20c421abc26d1f50afc
MD5 86dd0753017bc54ea11771b82d9680cb
SHA1 cbce300dcf51b8c242bd97d1a8b2f24719199283
SHA512 342e72340298145a54481bf2439872153cd684d0e6bfc4a4757bc157721975435b60dee616181696953796216cf6dc64db29b0e885b5670e7b2e4fdf1afbd63b
SSDEEP 1536:AVCKvg1Uo7W6HXjvC7RqN1jh2egaS7w4lcmJh9oQRKEB3SMQ:ofmUo7XHXzC7yhFeXmyh9o9EB3SMQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fellowship

Path C:\Users\Admin\AppData\Local\Temp\Fellowship
Size 51KB
SHA256 8d746180b3757a8bb6af017e278ed55f1fb581f65f23f51e43eef14e6f6ec17d
MD5 58fb7e3f879e283acc165dca8327a325
SHA1 13ef0f2a03ca390976267bf224bc1674ddafb37d
SHA512 b25fc894bf17d67ad62fdbc4fc0744af25a66294d687230ec8671224915372c8ea5408cd0bf057217f677f9822eb78278d39233eb131303c1ff8d3dedfb57142
SSDEEP 768:9E3ClmieIInWdpzK88yIq+qjK+Kip8Xp12XdDFYOoIHCJhGpcv/giSeD:8cCIIepelyF+qjK+KjXpw/5t+hozeD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Higher

Path C:\Users\Admin\AppData\Local\Temp\Higher
Size 72KB
SHA256 2fce4a26806fc82ca4102a5fd93a0ad6338fff812fbc400f087439362ed961f8
MD5 3b8bf47a8cfff3aa65cc4bc82d2f1a7b
SHA1 261c1433a8e73307555ff3609c175bb0987da05e
SHA512 523dcada289e640c0b418f4d8d17fd7fafadf07e01bde2d48cec9a84c137beb75e9e4fd35eb3561e84ddd675b7fbd4a20c5dac60a59ed1a24b144d6aca7598f9
SSDEEP 1536:4sVYe23FjoTUHsKsLWM/MLbTL1hEGEzoPPL0jBf9:4sVK5oTUHsKspM3TLjEG2oPD0J9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Innovations

Path C:\Users\Admin\AppData\Local\Temp\Innovations
Size 81KB
SHA256 15a82526a33ebfce05033766f6b9054a7e07a4e1e904aa89efbc8ad3925a9303
MD5 c53b54af05351be4f42da05b3def04c9
SHA1 229057f0131b55e8152bc47ffca0b3ddb43440bd
SHA512 03525b9000b6a5fad262c6e537fe50963eee2373791ae2cf173a23bf89b38c1274856fa7e4e61191b1004904855ba3cb07b51f95698d51ea81164bb3ec90135b
SSDEEP 1536:on7QZ2d9YRPnlBcwvUqtiHsnXZ3Sd7GBzkCIA:i7Jd9kPlBiMFSgBkPA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Junk

Path C:\Users\Admin\AppData\Local\Temp\Junk
Size 86KB
SHA256 60bd9b18204947e0c57edb861fbeb37c5b187ba22a24a37a710d3767e0893806
MD5 4854ad3bb2de6717b4604dae386e8735
SHA1 e6db96ecd91e2df6bef48c86899ad62505f20a86
SHA512 685b2a241769c0935d134fe4dd03683fd416998d7709bcb829c910ebb57137d390d70347b6f2127e782f06e685ef1ecbf80982bc637994d83d5cb4464ce78c46
SSDEEP 1536:uesq+VrhkrHBB7WBZ/rf7W0BF452SImh+IoIebot0CppcLTrMsz86diqqdEEw8nR:qq+VrhkttWzrCImh+lZdjYqqd9w8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator

Path C:\Users\Admin\AppData\Local\Temp\Locator
Size 51KB
SHA256 04a01f532ed7f16c83bab6ee3dc4a40c1ce085c6fab2c9965a52c2d1da1777c3
MD5 44f957cf6dc48b8dc6172e57cc89e8e5
SHA1 9b82721d4c07a947980a00d4a9e002e42dd98201
SHA512 68a8a187391f73948d15b892680a2499cd2747a74a9d98ec46b076d9c0897a7dd185c6e0d3330705185ec7e35b3991a3b26d30c86aeedc0e842b5d72fc38cd3f
SSDEEP 1536:16sCY9CJF27tNG/SbOeltIWOJlIyUFWE7yN7pLahfGtMQ:16GCJFsNKSRD7OJCV7yohkMQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nuke

Path C:\Users\Admin\AppData\Local\Temp\Nuke
Size 99KB
SHA256 6b3e1b83ee14b18eb7fde4e0804d706f1389f0cb151ba8fa2933e733773beb61
MD5 3308846aa767ed140327f884079d644a
SHA1 22815e4e79181506ddf19ef404ec70fbcda9a5f5
SHA512 f772e8f03bcfba93855075cbfd721c73021a88c287ed23252675124c9f43bf4a4e52c6f79e9724f3e2252570a8bf6ab0702b7a2a1d7a1855a491afb31038d8ab
SSDEEP 3072:TjMaEYnHZ1HO/MTHsfnysMO3kW2dOEa7as:vMaf5pO/aHsfyYLykH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Occasion

Path C:\Users\Admin\AppData\Local\Temp\Occasion
Size 84KB
SHA256 b72b98e7a4c332c3bbcb75f2663057b17b8057ea32d6c4888e0586f0b9a8c83c
MD5 6c10b68bf7aba704ece3ecc96f4b95f1
SHA1 e4644e930156619f34ef24f00470c441a5140314
SHA512 bddbcc422a5c1ee403046384d1b2541f5f515bba84f751e4e0ca6fea0a50d9713f578f46dc58c361905a2cbe0fa6dad93c99fbfa9cd75124d3e4fcc3a600654f
SSDEEP 1536:Qtw9Bt6e/eu8ig0TN1LACvzHb5qkPAH3CLiEz3sc5sJrc6zY3YqNY:yy/zzHb5lPAXKiiyJrlQo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pay

Path C:\Users\Admin\AppData\Local\Temp\Pay
Size 76KB
SHA256 682f34f554f796c0786b7c67dd3f0c27d548fe3dcb760b352ec21e75946046fa
MD5 adf6489b1a6cbaff9a5fd03fe8042d01
SHA1 e52c5ba48f8dcad3276f5de899c9c2ca9bd0c879
SHA512 6e6f0299bd2ac5423d9658342a2acd5326130c98dee169b3e2e9d24e753433b23db0f0b8460523f79ac1ea6b5d8e07c5a11d8f9a4777807834bd07238e45c15a
SSDEEP 1536:1yoyRlKcUokpZ2EJrn0QbpqjprgoJR9GAAfARAjMrwY36/S:liY7o02Eln0yAjpUobYpfZjMrB6/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Planes

Path C:\Users\Admin\AppData\Local\Temp\Planes
Size 90KB
SHA256 c4e653df2540f85654e9a6760a4ff2757ed2bb214109543fefa9b849a9a085a4
MD5 514930ccbdda4e08827dc6abf1d35a3a
SHA1 76684e3d93de907d7163e65fff83930854a67785
SHA512 69c46264825aacfbe527f6e824d087910ea6d02ab8d52eea88e163e27602983b1fc04e62a493fe0e70165126624a1b1f4f5a5d843c7403013377d0fd4f972820
SSDEEP 1536:oQLd7d6+MeTI47UUfhOx3koid7vUwMR9fZBPPfd4X/jbWKeDMGNA9IVf24NSl6x:ogd6e57UUfhY347ZMR9fZBd48RqQpSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Railroad

Path C:\Users\Admin\AppData\Local\Temp\Railroad
Size 92KB
SHA256 7f9d45fbfa44368bd8a55dfe1b19c5530be45cb32c9b17db34861934ff240553
MD5 a3b72986b91a93cc80723d256a16c6ea
SHA1 b4a16a8d7e2bc7068e1e0843cd7e4e63655570e2
SHA512 65239d800a2f3658b08b5c7a515bc04d515bf204dff45aa40f36d37e1204c3369f0225ed03c3f12c71a7faf41300719a0c8b0d810aca3929ff925bbf091b2c54
SSDEEP 1536:twefjG3qcNM6d6ZmkeE1BFQxRl2jLnsbPSY+ScL5eDp92XYpu0V7+B658:tw2jGfMyvnYW2HSqJVGHpuc7QS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Releases

Path C:\Users\Admin\AppData\Local\Temp\Releases
Size 63KB
SHA256 7e136bf84e068cac90ecf239eb901421eaf2691f164db0007a7acc562354850c
MD5 7fb358f9fa61d607ccf3a80e2b30bb6e
SHA1 84ed440c1ef86d09500dd80adac09f1114dcf688
SHA512 a9a59a4c317e28ecf1f4f85ea1746ed8d5d13a5711c87671af9357b6d72c07c17048a9ead185bc29eedc47c1a8133c1c6b32c83abf0ffab86b5c77067a93a09c
SSDEEP 1536:82ZlkZEPINJJQE/atujP94m5RTAqA1i0lNpkbJSa2:82ZcyNtuR5rGhaJp2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sampling

Path C:\Users\Admin\AppData\Local\Temp\Sampling
Size 73KB
SHA256 dec3eb5ec594ec5b84d41f9040d13280b43622eeb9c6ac34d294ad6c803bf7bc
MD5 da8abc322b34f150ada125abeb27b760
SHA1 b04b8310121e46fc1901c0c8a815520f4066093a
SHA512 50bafb440488132ea39021c9fece1f136e19916483b43d11db197d5fa72df578deca3cac8af6dbcfc5a2fea10658579f05e818f5303f9e59b3185ca5a6268870
SSDEEP 1536:PCLnoTrpB/JsrVWqxkBtTSO8uqdcY2kFSOmigf8fWEB535fS7u:PCLoTrp1Ky7V8Tda8iI56q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Screenshot

Path C:\Users\Admin\AppData\Local\Temp\Screenshot
Size 90KB
SHA256 3ef403f831de29368bda0483804832f65500fc5c43d1b0f4b090675330589ed7
MD5 dc541d0734dd7fd24bcadec2d98d46a4
SHA1 2cfb587db62271b41dff35a3abbb86eabc09b24e
SHA512 05b0fcad905408a663071fdb27cecb301c6f09f14e4a622b77d13753c7be83ba6208e79facfbe2341b761468e81aca77aede9a97e0f5a52ddb3beeca96f5be80
SSDEEP 1536:8mU++LjoU11mq4fX2Mxpea7peXwE9ZZDgf3HQi18U2XQ+LIrgjvcyQi:8ma1cfmMxpea7pywEhs5aZTygoNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shopping

Path C:\Users\Admin\AppData\Local\Temp\Shopping
Size 83KB
SHA256 93f2d28948fedd87e1f4d5aa6e6301c88b138125a3f7ef0bf2023a1f2e52f0aa
MD5 907ff27fe2f074a39d39a3289545d312
SHA1 2d63251c4b4538c2bd0005b2294d01f6a43e1955
SHA512 90badeb83667e072e4b583230237a1630a5cc33b1eb6374a83986faeee6cfa0c330ccc9c3895fa27a9386527019454d89002a518961c607618c6097938e63ad5
SSDEEP 1536:rgzbrFlf9E5LKJpyGHCCRsirUB9PrTcUB8LGW0UQyqc06FvTfHh8UD/4:+rbYLmyIFRZUMyHW06hlB94
MD5 SHA1 SHA512 SSDEEP

Submit Download

Skirts

Path C:\Users\Admin\AppData\Local\Temp\Skirts
Size 911KB
SHA256 a90890fb22c02d1f4cd668017cc76830d412011d2d01c48306820f870a7a9817
MD5 d1670fa3b18dc68dfa7240100cc66286
SHA1 b293d460a085aeff86620f11a14e0bd7c8cec2cf
SHA512 de421d7b0a6cb4e3c4bc3c3c3d500c03c5fc6f2cd0e2a3ef19fbaca7921f80e629db42f1a42cb42d25e87b1b29de9052cb785d68483678da6cad70da9f2629ef
SSDEEP 24576:MJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:MC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Swing

Path C:\Users\Admin\AppData\Local\Temp\Swing
Size 27KB
SHA256 79967f8cd81007ded7841643b89cdbe45f735bf8b8cf6608ee8fe166797c47b8
MD5 49b5fe73fb3ce14cc33bb20aa2fff02b
SHA1 2e2b6517667189a46c23b407edec120b79c7626e
SHA512 03625342b90d8ba5000855b77223af587a65fec205fed5c37ff2d5fdd63c1712e44931ce2dd4261e13760873cb20eeee04987c36019b770ab8ad9c4352d624d5
SSDEEP 768:C4u2+CKfkCldM18h70JWjxcxuOczDQWlm2k+yGfDydxuOc0ziwgeTcDnsQTk88dV:C4u2+nnl+ahw/as+opiXK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Texture

Path C:\Users\Admin\AppData\Local\Temp\Texture
Size 10KB
SHA256 3d049cc1bf849ceeced53798b4f924d4f57e77a632ede1ef539c1efee87bde64
MD5 d0a0cf2c907855f1064ddf91b76f21c3
SHA1 5245eb91f26d81b12b6ae5fc21f253e92f3a44d3
SHA512 e3b9038726ac30ead9d7020d30c05dc325e5dad506af27c6c2cf6f3b59d51b37b8a907e4d531e1b0c9bb74dc073b6ea28a64965a4125b62c617ebdc9cdcc814a
SSDEEP 192:plFWpOqoPzWaJNMqWzULI7NNiPN3UEdcQMMKAVhSo0QfLPlUZOZcP/u3:plFuOqohnWzR7NNilkEdpMMKAdbLPlUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Waiver

Path C:\Users\Admin\AppData\Local\Temp\Waiver
Size 60KB
SHA256 4ded02b2418a07abb23445ab56ccad835667f9f2a96d1a030f738209b0f865da
MD5 b1f9d3abcf001bd1bb798315fdfe39cb
SHA1 25f1c325a42163915e17a34dc69fe36f67223fcc
SHA512 ca88346d6cb2393240c3d2296ba5d54ef6b94dd7fdbb5c1be3a104ab0fb64542c43351664bf8ff5362e180f393a60b626551d443859051453fd6ba15c16cc217
SSDEEP 1536:cdF7BpoDdq3rzIsuVqyG/7j2Ah4NuV33ixP:cT7ByDw3PIsIeHN3W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wherever

Path C:\Users\Admin\AppData\Local\Temp\Wherever
Size 95KB
SHA256 2cda0fe6bbff9c7bf7252ec356f68881c521ed6ceeeebc9542ad87b943390d00
MD5 d09af5d18cad12006c6ac381273b407c
SHA1 95063cf75867de0bf91a37662f46bf5af236ea15
SHA512 9b9662af5336d531a87b9d6dac702b9f664c9dc3410424c82fc4f06bc539adc07f9a95924a4fb7904af2cd211b0e5634662218ae60f9681310aecdb395ad8648
SSDEEP 1536:N+coHtKdb+gVOxHLD7vI21hOcq8pnB3X4XgC/5kBt7F9OVCjhpQvop:gcBdb+e8HLD7vjoYnB3IpGv71hph
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp6FEB.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6FEB.tmp.bat
Size 155B
SHA256 e03acd232a17239c2f68c1233aa5e31e7b0340fa2cb82ad93470e78cfd9ef56a
MD5 cff9bb8feb6107ab45530acfc39ab94d
SHA1 d1b8f99d4361d519e9940fac3f6adf76ca10bc69
SHA512 4acd4456b10492e8982c352cd2d84d2b1364158f5c21aa338219574976b43a5c5dbb6104293fa9a52e0fc6b358f097af18faa179d3ffee7b061438c735a64ce0
MD5 SHA1 SHA512

Submit Download

tmp715E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp715E.tmp.bat
Size 155B
SHA256 f05c3e590f4fedea0ac9dffca1c2a560b5a9c493e22ca9ca933d1a339daa2704
MD5 ca70a562d017187efa3e4dd19057e222
SHA1 0bd8fee2794b2c70d6249445b4eb4a71f66435a4
SHA512 8c4fd031649d45e93d4027f741a321f7896870f5480d52e9ce343db8c407956adf6fa1d4bb49aa4178594bf6e33bcc99896e96e5679c2e0db18060d6dbd72d93
MD5 SHA1 SHA512

Submit Download

DataLogs.conf

Path C:\Users\Admin\AppData\Roaming\DataLogs\DataLogs.conf
Size 8B
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
MD5 SHA1 SHA512

Submit Download

winservices.exe

Path C:\Users\Admin\AppData\Roaming\winservices.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/736-639-0x0000000005900000-0x0000000005EA4000-memory.dmp

Download

memory/736-638-0x0000000000A30000-0x0000000000C7C000-memory.dmp

Download

memory/3720-651-0x0000000004AE0000-0x0000000004C3A000-memory.dmp

Download

memory/3720-650-0x0000000002490000-0x00000000024AA000-memory.dmp

Download

memory/3720-649-0x0000000000130000-0x0000000000170000-memory.dmp

Download

memory/4512-653-0x0000000000B60000-0x0000000000DAC000-memory.dmp

Download