asyncrat | 47b973dbadf02d2200588ee79fc33cd85ca2af4de5f3714d53cfd8c1e3acac73

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 5.8MB
Sample260930-gr5wvasfrc
SHA256 47b973dbadf02d2200588ee79fc33cd85ca2af4de5f3714d53cfd8c1e3acac73
MD5 0490b82c30ba4b3d5e9b9468bb73a56a
SHA1 613b0cf99ec341ff282122da4c11dcfc286bf622
SHA512 c8fe7de8c5cae2162fd58df87be0ba6f4052b5e32da057effe481b807eb833438e0a9f6c847535b3f7409c8c1b3878e8ecb9a1fcbd5ad600e9398af9a243dcd7
SSDEEP 49152:KskEQaOTbEWwtFH2grpL7c+7vOdoILN6Qrhjiig6vJNH2A3/eWaBmLmMF/SjTYoJ:KAOv4TH1FLWjj/yBSmgzqpG1x
TLSH
T18256BE8D8A62A6A7DC9B6BB54C518347B261BD063FE5F6C3352061380EB35CC483AFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution asyncrat stormkitty persistence rat stealer trojan

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	family_asyncrat

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	family_stormkitty
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	family_stormkitty

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables attemping to enumerate video devices using WMI 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing Discord tokens regular expressions 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_Discord_Regex
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex

Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing credit card regular expressions 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many VPN software clients. Observed in infosteslers 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_References_VPN
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_VPN

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information steale 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables with interest in wireless interface using netsh 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000001c4bc-72.dat	INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon
behavioral2/memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2564	powershell.exe
368	powershell.exe
2536	powershell.exe
764	powershell.exe
1476	powershell.exe
3224	powershell.exe
764	powershell.exe
1476	powershell.exe
2564	powershell.exe
368	powershell.exe
2536	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
6004	svchost.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe
368	powershell.exe
368	powershell.exe
2536	powershell.exe
2536	powershell.exe
764	powershell.exe
764	powershell.exe
1476	powershell.exe
1476	powershell.exe
3224	powershell.exe
3224	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeIncreaseQuotaPrivilege	2564	powershell.exe
Token: SeSecurityPrivilege	2564	powershell.exe
Token: SeTakeOwnershipPrivilege	2564	powershell.exe
Token: SeLoadDriverPrivilege	2564	powershell.exe
Token: SeSystemProfilePrivilege	2564	powershell.exe
Token: SeSystemtimePrivilege	2564	powershell.exe
Token: SeProfSingleProcessPrivilege	2564	powershell.exe
Token: SeIncBasePriorityPrivilege	2564	powershell.exe
Token: SeCreatePagefilePrivilege	2564	powershell.exe
Token: SeBackupPrivilege	2564	powershell.exe
Token: SeRestorePrivilege	2564	powershell.exe
Token: SeShutdownPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeSystemEnvironmentPrivilege	2564	powershell.exe
Token: SeRemoteShutdownPrivilege	2564	powershell.exe
Token: SeUndockPrivilege	2564	powershell.exe
Token: SeManageVolumePrivilege	2564	powershell.exe
Token: 33	2564	powershell.exe
Token: 34	2564	powershell.exe
Token: 35	2564	powershell.exe
Token: 36	2564	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeIncreaseQuotaPrivilege	368	powershell.exe
Token: SeSecurityPrivilege	368	powershell.exe
Token: SeTakeOwnershipPrivilege	368	powershell.exe
Token: SeLoadDriverPrivilege	368	powershell.exe
Token: SeSystemProfilePrivilege	368	powershell.exe
Token: SeSystemtimePrivilege	368	powershell.exe
Token: SeProfSingleProcessPrivilege	368	powershell.exe
Token: SeIncBasePriorityPrivilege	368	powershell.exe
Token: SeCreatePagefilePrivilege	368	powershell.exe
Token: SeBackupPrivilege	368	powershell.exe
Token: SeRestorePrivilege	368	powershell.exe
Token: SeShutdownPrivilege	368	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeSystemEnvironmentPrivilege	368	powershell.exe
Token: SeRemoteShutdownPrivilege	368	powershell.exe
Token: SeUndockPrivilege	368	powershell.exe
Token: SeManageVolumePrivilege	368	powershell.exe
Token: 33	368	powershell.exe
Token: 34	368	powershell.exe
Token: 35	368	powershell.exe
Token: 36	368	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeIncreaseQuotaPrivilege	2536	powershell.exe
Token: SeSecurityPrivilege	2536	powershell.exe
Token: SeTakeOwnershipPrivilege	2536	powershell.exe
Token: SeLoadDriverPrivilege	2536	powershell.exe
Token: SeSystemProfilePrivilege	2536	powershell.exe
Token: SeSystemtimePrivilege	2536	powershell.exe
Token: SeProfSingleProcessPrivilege	2536	powershell.exe
Token: SeIncBasePriorityPrivilege	2536	powershell.exe
Token: SeCreatePagefilePrivilege	2536	powershell.exe
Token: SeBackupPrivilege	2536	powershell.exe
Token: SeRestorePrivilege	2536	powershell.exe
Token: SeShutdownPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeSystemEnvironmentPrivilege	2536	powershell.exe
Token: SeRemoteShutdownPrivilege	2536	powershell.exe
Token: SeUndockPrivilege	2536	powershell.exe
Token: SeManageVolumePrivilege	2536	powershell.exe
Token: 33	2536	powershell.exe
Token: 34	2536	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 2564	5684	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	90
PID 5684 wrote to memory of 368	5684	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	93
PID 5684 wrote to memory of 2536	5684	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	95
PID 5684 wrote to memory of 764	5684	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	97
PID 5684 wrote to memory of 1476	5684	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	99
PID 5684 wrote to memory of 3224	5684	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	101
PID 5684 wrote to memory of 6004	5684	2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess '2026-09-29_0490b82c30ba4b3d5e9b9468bb73a56a_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d4d2ce62db0b4bca98a26c119723a5dbeb712c439f9ef80099c3553c4a535f2e
MD5 e7165bfe581c15b988ad1dd2a7a9e519
SHA1 318e662e4198bcb701a2b79db7fc391ad9ba37b5
SHA512 093195cd1bb6bb582f322a8101c4e86b4ec96eddaad363711aa4d8a33653e2d791b0d1887cb3857a8094bb43434f9ef9c34747c5c981becca9cac20e90922902
TLSH
T11C216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zpfn2sbu.mai.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zpfn2sbu.mai.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 3.2MB
SHA256 36000cf7fdd62dfbb680780d3a67925108501a86ccceeba6d9bc0824da17feeb
MD5 b1dcba2a9bf5208a1e8afac50788e6e4
SHA1 2a3698110fd9b78a82befc388c1a721bfc805601
SHA512 764c24033dbe0c1cfdbdf7e256ce4be12c36da1dc4a7e2022b3675772883ea60f890104762da70e1c9c34ce837455997baa15929ce50b924db91cf2b8162ee40
SSDEEP 49152:p4osaQV3K0+5kCexDJjNzuMAzULcdBdo+6WuDayPWr/NJJ:ps3K0XCE9+T
TLSH
T130F54B41ABE8CE1AE1BF2775A4F200125BB1F449E732DB4B1694E6792C637406D0A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-40-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-34-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-41-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-26-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-39-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-38-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-35-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-43-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-33-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-68-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-31-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-74-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-30-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/368-27-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-15-0x00000173A0930000-0x00000173A09E2000-memory.dmp

Download

memory/2564-0-0x00007FF9C019F000-0x00007FF9C01A0000-memory.dmp

Download

memory/2564-23-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-22-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-21-0x00000173A08F0000-0x00000173A08FA000-memory.dmp

Download

memory/2564-20-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-19-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-18-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-17-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-16-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-14-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-25-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-13-0x00000173A0910000-0x00000173A092E000-memory.dmp

Download

memory/2564-10-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-8-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-9-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-7-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-6-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-5-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-4-0x00007FF9C0010000-0x00007FF9C09B4000-memory.dmp

Download

memory/2564-3-0x00000173A0870000-0x00000173A0892000-memory.dmp

Download

memory/6004-73-0x0000000000ED0000-0x000000000120C000-memory.dmp

Download