asyncrat | 9ee369ad690ea79c029365597fee8463e738dbeb15cb2bff10ac12b35cd6287d

Analysis

max time kernel
95s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

esmo2.ps1
Size

6KB
MD5

ded5f63456e1d0dcb17aa8688d57e4c7
SHA1

4c7c84a426936401f9e4556abe454ac688fb7f05
SHA256

9ee369ad690ea79c029365597fee8463e738dbeb15cb2bff10ac12b35cd6287d
SHA512

0569e96ae73260b3a7ec6e7a5cac5bd2f429ac37a6be164556dfb1d813c8a9d10c06bcfd79110813e4f7377ca867daf542969c9d17c43eb71c9bec87c7bc037c
SSDEEP

96:Bbz+T3G8B8gSsAfKt4zw1O4GWA9E7A/xRnhiE7MVyt8MYKJLVG01Waw:BbGW8B8XJg4UMLWmEk59hiPy6EL1hw

Score

10^/10

asyncrat dozzy[1]discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Dozzy[1]

Mutex

Setup_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/AJqrj5ZH

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Blocklisted process makes network request 10 IoCs

flow	pid	Process
22	2304	powershell.exe
25	2304	powershell.exe
54	1976	powershell.exe
55	1976	powershell.exe
56	916	powershell.exe
57	916	powershell.exe
59	4780	powershell.exe
60	4780	powershell.exe
61	1080	powershell.exe
62	1080	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4104	powershell.exe
1976	powershell.exe
916	powershell.exe
4780	powershell.exe
2304	powershell.exe
1080	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	CScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
21	pastebin.com
22	pastebin.com
32	pastebin.com
54	pastebin.com
56	pastebin.com
59	pastebin.com
61	pastebin.com

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2304 set thread context of 4316	2304	powershell.exe	104
PID 1976 set thread context of 2956	1976	powershell.exe	129
PID 916 set thread context of 3324	916	powershell.exe	134
PID 4780 set thread context of 2320	4780	powershell.exe	136
PID 1080 set thread context of 1532	1080	powershell.exe	137

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4104	powershell.exe
4104	powershell.exe
2304	powershell.exe
2304	powershell.exe
4316	RegSvcs.exe
1976	powershell.exe
1976	powershell.exe
916	powershell.exe
916	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
1976	powershell.exe
1976	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
916	powershell.exe
916	powershell.exe
4780	powershell.exe
4780	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeIncreaseQuotaPrivilege	4104	powershell.exe
Token: SeSecurityPrivilege	4104	powershell.exe
Token: SeTakeOwnershipPrivilege	4104	powershell.exe
Token: SeLoadDriverPrivilege	4104	powershell.exe
Token: SeSystemProfilePrivilege	4104	powershell.exe
Token: SeSystemtimePrivilege	4104	powershell.exe
Token: SeProfSingleProcessPrivilege	4104	powershell.exe
Token: SeIncBasePriorityPrivilege	4104	powershell.exe
Token: SeCreatePagefilePrivilege	4104	powershell.exe
Token: SeBackupPrivilege	4104	powershell.exe
Token: SeRestorePrivilege	4104	powershell.exe
Token: SeShutdownPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeSystemEnvironmentPrivilege	4104	powershell.exe
Token: SeRemoteShutdownPrivilege	4104	powershell.exe
Token: SeUndockPrivilege	4104	powershell.exe
Token: SeManageVolumePrivilege	4104	powershell.exe
Token: 33	4104	powershell.exe
Token: 34	4104	powershell.exe
Token: 35	4104	powershell.exe
Token: 36	4104	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	4316	RegSvcs.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4316	RegSvcs.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3212	5076	WScript.exe	91
PID 5076 wrote to memory of 3212	5076	WScript.exe	91
PID 3212 wrote to memory of 2304	3212	cmd.exe	93
PID 3212 wrote to memory of 2304	3212	cmd.exe	93
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2304 wrote to memory of 4316	2304	powershell.exe	104
PID 2296 wrote to memory of 1976	2296	cmd.exe	115
PID 2296 wrote to memory of 1976	2296	cmd.exe	115
PID 2480 wrote to memory of 316	2480	WScript.exe	118
PID 2480 wrote to memory of 316	2480	WScript.exe	118
PID 316 wrote to memory of 916	316	cmd.exe	120
PID 316 wrote to memory of 916	316	cmd.exe	120
PID 116 wrote to memory of 4444	116	CScript.exe	124
PID 116 wrote to memory of 4444	116	CScript.exe	124
PID 4444 wrote to memory of 4780	4444	cmd.exe	126
PID 4444 wrote to memory of 4780	4444	cmd.exe	126
PID 1976 wrote to memory of 3504	1976	powershell.exe	128
PID 1976 wrote to memory of 3504	1976	powershell.exe	128
PID 1976 wrote to memory of 3504	1976	powershell.exe	128
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 1976 wrote to memory of 2956	1976	powershell.exe	129
PID 916 wrote to memory of 2556	916	powershell.exe	133
PID 916 wrote to memory of 2556	916	powershell.exe	133
PID 916 wrote to memory of 2556	916	powershell.exe	133
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 916 wrote to memory of 3324	916	powershell.exe	134
PID 4780 wrote to memory of 4396	4780	powershell.exe	135
PID 4780 wrote to memory of 4396	4780	powershell.exe	135
PID 4780 wrote to memory of 4396	4780	powershell.exe	135
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 4780 wrote to memory of 2320	4780	powershell.exe	136
PID 1080 wrote to memory of 1532	1080	powershell.exe	137
PID 1080 wrote to memory of 1532	1080	powershell.exe	137
PID 1080 wrote to memory of 1532	1080	powershell.exe	137
PID 1080 wrote to memory of 1532	1080	powershell.exe	137
PID 1080 wrote to memory of 1532	1080	powershell.exe	137
PID 1080 wrote to memory of 1532	1080	powershell.exe	137
PID 1080 wrote to memory of 1532	1080	powershell.exe	137
PID 1080 wrote to memory of 1532	1080	powershell.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\esmo2.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\vortex.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\vortex.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\vortex.ps1'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\vortex.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\vortex.ps1'"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3504
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2956

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\vortex.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\vortex.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\vortex.ps1'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:2556
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324

C:\Windows\System32\CScript.exe
"C:\Windows\System32\CScript.exe" "C:\Users\Public\vortex.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\vortex.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\vortex.ps1'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4396
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Public\vortex.ps1'"
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
00e7da020005370a518c26d5deb40691

SHA1
389b34fdb01997f1de74a5a2be0ff656280c0432

SHA256
a529468d442b807290b41565130e4c52760af9abec37613114db3857f11ad4fe

SHA512
9a02bacc6fb922d6202548e80e345c6cdec346b79ef7ac7a56f89fd342ff128de004065b9d010d015b54d4ca72f665ca658c7ffcd8eb906e14bfa5b48b43f2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d0f3eff52698c0eab8a2c8bd1d9f7c18

SHA1
4292ae775443749c6c2281dac800d86b4bdde07e

SHA256
b16c74cbb71b5ba7bbf32696feb6869d9a0fa3bac42042a3fe8f3d48e2d5dbf6

SHA512
642b5d51a4cec6094e6789f29eb68885068583a08e102606b7ed2ace036cacd8b3bc428cef6f8cbfaadf5644fe52149211f7fc6774fc4ff458bd76cfae703cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
efca4fbb6ed88364b72fed963cf6810c

SHA1
c999d75d6e95bfa590e6f688deac1a228023fac9

SHA256
a999953b876efaa39c9aa68a59a1143ab40bca01e353b01b406724acabf658a3

SHA512
4a70f7b0bbbd27f86dded4d2017cf21f41f13f43f2583463184297ce5aed4127401c89f4903cbea9977337e5cb28978a9201cd4fabe45af185d1f85c9bfa894f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6e8fdd96b0ba86ad844db19760bcb754

SHA1
5d526dbb6eb01120250fa7099a01c1ec31e5b420

SHA256
579d62d98d7f95543396bbd899ec3325567ec1da59d555e082e57fcc98e95dec

SHA512
12e44931a87df6fba28f5741233d7804baf867020273eb99ae8106155a1a94487234aa2513f02ed0ebd0a0fb0d2e881ea7fecf872542db4643764ec936fb5870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6ddd9c56a681834b3ddd7863f0141f29

SHA1
bfe7c8d1215e62b60f1b1ae3b7932aef42f8bed5

SHA256
78508c5af5ab58269c7df8d21a3b83c89588d3813e318402872b34fdaca07036

SHA512
45a12c3344bf2974747af8d30d5248487ad0bb55e652b46fb1b4f2c51bba74a211f2f84fbc534d0407f304b8b648c2b3dea17094309af1fc47e69e50f03e35e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8e94a2581dac828b9c654eb86b70e133

SHA1
883d9516530908bd1444da5965941a372e08d949

SHA256
7c24216d0d30b211c2f9feb8a4cf82d3919fb5b71b20cac064d7eb23f86b008c

SHA512
f4804fc53931f60c799b8928b7356725ea0217ff4c89b9791544136710e27b35a59608e8bfffc20977e9ec20db0cdcddf33910a0096cb56f10e7cf4d89b7072b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnmpgstu.fz0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\vortex.bat

Filesize
205B

MD5
9e080ffad515e7422eae88b1603dd245

SHA1
f778fc7bab19fa683955adb8e5b9a6a0d3e98799

SHA256
8ac42d8ea294305e1c06e2f1ccc0d2350f39b0b53d42046422ad6d88d73f7357

SHA512
9bca376fae8397e52c0afaed7d4e17a0628c8b275ebae621f42e7ed42f17193ca4a49ded1c58de7386683d7a1afd833869eb8dd173ea3ad1bc07ecb84284c0c7

Download Submit
C:\Users\Public\vortex.ps1

Filesize
1KB

MD5
f9dc0278e74ac6d1a1f5f50b999c0a5e

SHA1
ba421db1f095723a4aeda75e765a735ad134127a

SHA256
7fdb7bfb4197e8123f31adda277d82a119596dcd6d3fea3b115cb0f45eab59a3

SHA512
ca7933f3edde71d6ac50bb5e31c57f77bb75e6c3cd53984271934abec62c54a349e61f902c25e003d35dfe623c0d630afce6b7131c2fd07cee68c2ee4c32ddc8

Download Submit
C:\Users\Public\vortex.vbs

Filesize
1KB

MD5
0308ee03b5a25139600c8b9ef7341b00

SHA1
8c33169449f22fdf32559b59752cd0de01595bf0

SHA256
786fd0de97c74547db9b970afa4eed09e16583b4ad5a2142ef42122068ac1f5b

SHA512
d813a012e35e2760a144aa1e05b80502fb2bfadfe5be620a8fdcde8e38c4068e91be2924c22fac351f6ec0b3d858f331eeebc6de9c91054fd31e1733a2d52ea5

Download Submit
memory/2304-38-0x00000160778A0000-0x00000160778BA000-memory.dmp

Filesize
104KB

Download
memory/2304-37-0x0000016077EE0000-0x00000160780A2000-memory.dmp

Filesize
1.8MB

Download
memory/4104-18-0x00007FFE012B3000-0x00007FFE012B5000-memory.dmp

Filesize
8KB

Download
memory/4104-17-0x00007FFE012B0000-0x00007FFE01D71000-memory.dmp

Filesize
10.8MB

Download
memory/4104-19-0x00007FFE012B0000-0x00007FFE01D71000-memory.dmp

Filesize
10.8MB

Download
memory/4104-0-0x00007FFE012B3000-0x00007FFE012B5000-memory.dmp

Filesize
8KB

Download
memory/4104-22-0x00007FFE012B0000-0x00007FFE01D71000-memory.dmp

Filesize
10.8MB

Download
memory/4104-11-0x00007FFE012B0000-0x00007FFE01D71000-memory.dmp

Filesize
10.8MB

Download
memory/4104-8-0x0000025D1A070000-0x0000025D1A092000-memory.dmp

Filesize
136KB

Download
memory/4104-12-0x00007FFE012B0000-0x00007FFE01D71000-memory.dmp

Filesize
10.8MB

Download
memory/4104-16-0x00007FFE012B0000-0x00007FFE01D71000-memory.dmp

Filesize
10.8MB

Download
memory/4316-39-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4316-47-0x00000000069B0000-0x0000000006A16000-memory.dmp

Filesize
408KB

Download
memory/4316-46-0x0000000006700000-0x000000000679C000-memory.dmp

Filesize
624KB

Download
memory/4316-43-0x0000000005A00000-0x0000000005A0A000-memory.dmp

Filesize
40KB

Download
memory/4316-42-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/4316-41-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Filesize
5.6MB

Download