umbral | hxxps://mega[.]nz/file/YOdhHAIY#jTm_5DeoMeP7VUQ0n2dVUwp34y2nBaRFF3d25T8MZis

Resubmissions

18-06-2023 15:17

230618-sn2wkaha9x 10

18-06-2023 15:15

230618-snd5haga56 1

18-06-2023 15:15

230618-sm1xwaga54 10

Analysis

max time kernel
237s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2023 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/YOdhHAIY#jTm_5DeoMeP7VUQ0n2dVUwp34y2nBaRFF3d25T8MZis

Score

10^/10

umbral stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1080132753695182890/OM88z5U1CQlUDMQ1n3UcwRfJ2sRQBlvT6lYXqOseT-tGSfD3DocUvIPJtq9zz0WItMTc

Signatures

Detect Umbral payload 30 IoCs

resource	yara_rule
behavioral1/files/0x000500000001e7fd-412.dat	family_umbral
behavioral1/files/0x000500000001e7fd-550.dat	family_umbral
behavioral1/files/0x000500000001e7fd-551.dat	family_umbral
behavioral1/memory/5852-552-0x0000018E665E0000-0x0000018E66620000-memory.dmp	family_umbral
behavioral1/files/0x000500000001e7fd-568.dat	family_umbral
behavioral1/files/0x000500000001e7fd-571.dat	family_umbral
behavioral1/files/0x000500000001e7fd-573.dat	family_umbral
behavioral1/files/0x000500000001e7fd-574.dat	family_umbral
behavioral1/files/0x000500000001e7fd-576.dat	family_umbral
behavioral1/files/0x000500000001e7fd-764.dat	family_umbral
behavioral1/files/0x000500000001e7fd-768.dat	family_umbral
behavioral1/files/0x000500000001e7fd-769.dat	family_umbral
behavioral1/files/0x000500000001e7fd-770.dat	family_umbral
behavioral1/files/0x000500000001e7fd-771.dat	family_umbral
behavioral1/files/0x000500000001e7fd-812.dat	family_umbral
behavioral1/files/0x000500000001e7fd-813.dat	family_umbral
behavioral1/files/0x000500000001e7fd-814.dat	family_umbral
behavioral1/files/0x000500000001e7fd-816.dat	family_umbral
behavioral1/files/0x000500000001e7fd-817.dat	family_umbral
behavioral1/files/0x000500000001e7fd-818.dat	family_umbral
behavioral1/files/0x00060000000231dc-1004.dat	family_umbral
behavioral1/files/0x00060000000231dc-1005.dat	family_umbral
behavioral1/files/0x00060000000231dc-1009.dat	family_umbral
behavioral1/files/0x00060000000231dc-1010.dat	family_umbral
behavioral1/files/0x00060000000231dc-1011.dat	family_umbral
behavioral1/files/0x00060000000231dc-1012.dat	family_umbral
behavioral1/files/0x00060000000231dc-1013.dat	family_umbral
behavioral1/files/0x00060000000231dc-1014.dat	family_umbral
behavioral1/files/0x00060000000231dc-1015.dat	family_umbral
behavioral1/files/0x00060000000231dc-1016.dat	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	rundll32.exe

Executes dropped EXE 32 IoCs

pid	Process
5852	Palm.exe
6056	Palm.exe
5152	Palm.exe
1916	Palm.exe
680	Palm.exe
2224	Palm.exe
3636	Palm.exe
4504	Palm.exe
5624	Palm.exe
1012	Palm.exe
4996	Palm.exe
6056	Palm.exe
6008	Palm.exe
3028	Palm.exe
5952	Palm.exe
736	Palm.exe
3868	Palm.exe
2912	Palm.exe
4104	Palm.exe
3624	Palm.exe
2228	Palm.exe
5020	Palm.exe
740	Palm.exe
5572	Palm.exe
2468	Palm.exe
4528	Palm.exe
5720	Palm.exe
4364	Palm.exe
4224	Palm.exe
4840	Palm.exe
876	Palm.exe
4752	Palm.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c3ddb805-e12e-44a2-888f-8712c5656bc2.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230618152057.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "156524057"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a3000cf8a1d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{34BE0529-0DEB-11EE-B7D7-FE76446D24E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31039992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "156524057"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31039992"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094a99f6bd699934f9cf5369f00b3449d00000000020000000000106600000001000020000000208235a5a97e1d03452b7458d955320b54caf40f20e1475a90dc14f6ba6cdeb6000000000e8000000002000020000000ff0ccdf0169ce40f26ba9369361a2e71efe5d689a8b32623d6f290fd7adbbccc200000006d3578b279d3230f0b685e79a1d3cc0748b7ffd93f9e33ad790b57784fae5b91400000003c025228a37fb01e855724b2248ddbb2feb65a149ec4ffd1c2dfb3a9c776c691dfe1fc88fce10a480eba0cc75cc3e6fae85baa837dd7018236526fb82f527523	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094a99f6bd699934f9cf5369f00b3449d00000000020000000000106600000001000020000000879bb5a825bdbd2de01da50b536e5da350fbc0eba4ee91854f8fa1a9576fff60000000000e80000000020000200000001450dcc2147ae9190ccedf6b21e1c2075ea5de849ac15d25a5af93a196c701802000000071a49910c34fc911562a9d5aed60e505e732ddbfe912255ab77b6414f0a673c440000000429a20629f4ee39cf87afb93218307f48f9cef878932c785ebfeab1010fb07da8fa178af1a3b909db140162ec4fe874c1fd081d13b49984b60756120faa8af21	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900cd80bf8a1d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 258917.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\Downloads\Palm.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3356	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5968	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	firefox.exe
Token: SeDebugPrivilege	2236	firefox.exe
Token: 33	5216	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5216	AUDIODG.EXE
Token: SeDebugPrivilege	5852	Palm.exe
Token: SeIncreaseQuotaPrivilege	4508	wmic.exe
Token: SeSecurityPrivilege	4508	wmic.exe
Token: SeTakeOwnershipPrivilege	4508	wmic.exe
Token: SeLoadDriverPrivilege	4508	wmic.exe
Token: SeSystemProfilePrivilege	4508	wmic.exe
Token: SeSystemtimePrivilege	4508	wmic.exe
Token: SeProfSingleProcessPrivilege	4508	wmic.exe
Token: SeIncBasePriorityPrivilege	4508	wmic.exe
Token: SeCreatePagefilePrivilege	4508	wmic.exe
Token: SeBackupPrivilege	4508	wmic.exe
Token: SeRestorePrivilege	4508	wmic.exe
Token: SeShutdownPrivilege	4508	wmic.exe
Token: SeDebugPrivilege	4508	wmic.exe
Token: SeSystemEnvironmentPrivilege	4508	wmic.exe
Token: SeRemoteShutdownPrivilege	4508	wmic.exe
Token: SeUndockPrivilege	4508	wmic.exe
Token: SeManageVolumePrivilege	4508	wmic.exe
Token: 33	4508	wmic.exe
Token: 34	4508	wmic.exe
Token: 35	4508	wmic.exe
Token: 36	4508	wmic.exe
Token: SeIncreaseQuotaPrivilege	4508	wmic.exe
Token: SeSecurityPrivilege	4508	wmic.exe
Token: SeTakeOwnershipPrivilege	4508	wmic.exe
Token: SeLoadDriverPrivilege	4508	wmic.exe
Token: SeSystemProfilePrivilege	4508	wmic.exe
Token: SeSystemtimePrivilege	4508	wmic.exe
Token: SeProfSingleProcessPrivilege	4508	wmic.exe
Token: SeIncBasePriorityPrivilege	4508	wmic.exe
Token: SeCreatePagefilePrivilege	4508	wmic.exe
Token: SeBackupPrivilege	4508	wmic.exe
Token: SeRestorePrivilege	4508	wmic.exe
Token: SeShutdownPrivilege	4508	wmic.exe
Token: SeDebugPrivilege	4508	wmic.exe
Token: SeSystemEnvironmentPrivilege	4508	wmic.exe
Token: SeRemoteShutdownPrivilege	4508	wmic.exe
Token: SeUndockPrivilege	4508	wmic.exe
Token: SeManageVolumePrivilege	4508	wmic.exe
Token: 33	4508	wmic.exe
Token: 34	4508	wmic.exe
Token: 35	4508	wmic.exe
Token: 36	4508	wmic.exe
Token: SeDebugPrivilege	5968	taskmgr.exe
Token: SeSystemProfilePrivilege	5968	taskmgr.exe
Token: SeCreateGlobalPrivilege	5968	taskmgr.exe
Token: SeDebugPrivilege	6056	Palm.exe
Token: SeIncreaseQuotaPrivilege	1728	wmic.exe
Token: SeSecurityPrivilege	1728	wmic.exe
Token: SeTakeOwnershipPrivilege	1728	wmic.exe
Token: SeLoadDriverPrivilege	1728	wmic.exe
Token: SeSystemProfilePrivilege	1728	wmic.exe
Token: SeSystemtimePrivilege	1728	wmic.exe
Token: SeProfSingleProcessPrivilege	1728	wmic.exe
Token: SeIncBasePriorityPrivilege	1728	wmic.exe
Token: SeCreatePagefilePrivilege	1728	wmic.exe
Token: SeBackupPrivilege	1728	wmic.exe
Token: SeRestorePrivilege	1728	wmic.exe
Token: SeShutdownPrivilege	1728	wmic.exe
Token: SeDebugPrivilege	1728	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1984	iexplore.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe
5968	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
3628	IEXPLORE.EXE
3628	IEXPLORE.EXE
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3628	1984	iexplore.exe	82
PID 1984 wrote to memory of 3628	1984	iexplore.exe	82
PID 1984 wrote to memory of 3628	1984	iexplore.exe	82
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 4660 wrote to memory of 2236	4660	firefox.exe	87
PID 2236 wrote to memory of 736	2236	firefox.exe	88
PID 2236 wrote to memory of 736	2236	firefox.exe	88
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89
PID 2236 wrote to memory of 1364	2236	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://mega.nz/file/YOdhHAIY#jTm_5DeoMeP7VUQ0n2dVUwp34y2nBaRFF3d25T8MZis
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.0.80615181\43033388" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1784 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57d4d6b6-61e6-4472-8f62-4973cd1762e3} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 1932 1ed13419b58 gpu
    3⤵
    PID:736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.1.618778392\595256587" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40c81c94-9ad3-456f-8595-cf0f78071bbc} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 2316 1ed05572858 socket
    3⤵
    - Checks processor information in registry
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.2.1771195408\699746375" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 3076 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {101ddc71-9a5a-44be-99ad-6e4d64d435a3} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 2928 1ed160f2a58 tab
    3⤵
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.3.1312642694\489130775" -childID 2 -isForBrowser -prefsHandle 2348 -prefMapHandle 2360 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f23be29e-e516-4387-9432-dccc9e40288b} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 1204 1ed0555ca58 tab
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.4.1547815910\1066795675" -childID 3 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6016e747-71a4-4bf2-901e-074ebb6ba719} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 4032 1ed15bccb58 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.7.638339732\1667735180" -childID 6 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9815a645-b49b-4fd7-8405-fa8c3650d9da} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 5276 1ed189c7f58 tab
    3⤵
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.6.684451596\1632145155" -childID 5 -isForBrowser -prefsHandle 4964 -prefMapHandle 5004 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c8d2cd6-3cb3-422d-b1d3-7627b521ffcc} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 4924 1ed189c7058 tab
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.5.867939620\813228069" -childID 4 -isForBrowser -prefsHandle 4956 -prefMapHandle 4968 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb9e6cc4-b59e-4d63-9596-f32c18ec5b25} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 4964 1ed18721358 tab
    3⤵
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.8.174209872\705105571" -childID 7 -isForBrowser -prefsHandle 5732 -prefMapHandle 5796 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2329769-f9b0-4881-a667-a49c90ebd5f0} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 5596 1ed1a235858 tab
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.9.1513868125\2105469397" -childID 8 -isForBrowser -prefsHandle 3600 -prefMapHandle 3616 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {970b69b2-61d4-4baf-8465-abe11b2b39e7} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 3588 1ed1230e058 tab
    3⤵
    PID:1152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5676

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5852
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4508

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\EditPush.reg"
1⤵
- Opens file in notepad (likely ransom note)
PID:3356

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5968

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6056
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1728

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:5152
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4512

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:1916
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4224

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:680
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:1448

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:2224
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5416

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Users\Admin\Desktop\Palm.exe" ContextMenu
1⤵
PID:1732
- C:\Windows\System32\msdt.exe
  C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCWD93.xml /skip TRUE
  2⤵
  PID:1660
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\Palm.exe"
    3⤵
    - Checks computer location settings
    PID:4304
  - - C:\Users\Admin\Desktop\Palm.exe
      "C:\Users\Admin\Desktop\Palm.exe"
      4⤵
      Executes dropped EXE
      PID:3636
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:1664
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\Palm.exe"
    3⤵
    - Checks computer location settings
    PID:5508
  - - C:\Users\Admin\Desktop\Palm.exe
      "C:\Users\Admin\Desktop\Palm.exe"
      4⤵
      Executes dropped EXE
      PID:4504
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:3732
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\Palm.exe"
    3⤵
    - Checks computer location settings
    PID:4880
  - - C:\Users\Admin\Desktop\Palm.exe
      "C:\Users\Admin\Desktop\Palm.exe"
      4⤵
      Executes dropped EXE
      PID:5624
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\Palm.exe"
    3⤵
    - Checks computer location settings
    PID:4580
  - - C:\Users\Admin\Desktop\Palm.exe
      "C:\Users\Admin\Desktop\Palm.exe"
      4⤵
      Executes dropped EXE
      PID:1012
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\pcwutl.dll,LaunchApplication "C:\Users\Admin\Desktop\Palm.exe"
    3⤵
    - Checks computer location settings
    PID:336
  - - C:\Users\Admin\Desktop\Palm.exe
      "C:\Users\Admin\Desktop\Palm.exe"
      4⤵
      Executes dropped EXE
      PID:4996
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:1792

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
PID:4196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tkwiygqw\tkwiygqw.cmdline"
  2⤵
  PID:5880
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1543.tmp" "c:\Users\Admin\AppData\Local\Temp\tkwiygqw\CSC8017872976264C5089F54C25EF3D4CB8.TMP"
    3⤵
    PID:5928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ovnb10ut\ovnb10ut.cmdline"
  2⤵
  PID:1720
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16CA.tmp" "c:\Users\Admin\AppData\Local\Temp\ovnb10ut\CSCA07E79367E8E470AA83B1371C3386E30.TMP"
    3⤵
    PID:5856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zuev3jb1\zuev3jb1.cmdline"
  2⤵
  PID:2084
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1C87.tmp" "c:\Users\Admin\AppData\Local\Temp\zuev3jb1\CSCEF219620EE0C4E09A0D9DF385F92297.TMP"
    3⤵
    PID:1860

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:6056
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3300

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:6008

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:3028

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:5952

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:736
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2328

C:\Users\Admin\Desktop\Palm.exe
"C:\Users\Admin\Desktop\Palm.exe"
1⤵
- Executes dropped EXE
PID:3868
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" C:\Users\Admin\Desktop\Palm.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8645b46f8,0x7ff8645b4708,0x7ff8645b4718
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x200,0x248,0x7ff73d775460,0x7ff73d775470,0x7ff73d775480
    3⤵
    PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:5044
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:2912
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:5676
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5100
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:5020
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5616
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16135378138576288564,16097639705465372208,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:380
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:5572
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:2468
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:1076
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:5720
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:4364
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5240
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:1328
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Users\Admin\Downloads\Palm.exe
  "C:\Users\Admin\Downloads\Palm.exe"
  2⤵
  - Executes dropped EXE
  PID:4752
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2023061815.000\PCW.debugreport.xml

Filesize
3KB

MD5
0a0b3726ef737916dbbf5d883f3c37ba

SHA1
85115ed6278d44178758dc454f7d0ef644a8659f

SHA256
c515ebd8a0e23b134bffb2006b81f7e6557e51fd4c652acd83f1602fb8095c92

SHA512
535b3426dad54d5c61e4d43de0b1dc4f5f8453018188701cc78cb97b2266b58bb29ccbecb79bec217f7e174bd0b6c83cf8e642070f942914b8be216dd0e45027

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2023061815.000\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Palm.exe.log

Filesize
1KB

MD5
8094b248fe3231e48995c2be32aeb08c

SHA1
2fe06e000ebec919bf982d033c5d1219c1f916b6

SHA256
136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc

SHA512
bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1db53baf44edd6b1bc2b7576e2f01e12

SHA1
e35739fa87978775dcb3d8df5c8d2063631fa8df

SHA256
0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48

SHA512
84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
dcae552634ab3490939cf5687a95d461

SHA1
b67ee5f04690a5569dc71337972981c9cefe82a1

SHA256
80a3f2bba6fa1a001aea2b9ade1e9de1881a75888de1a0986ee7caf16ea84c16

SHA512
d903f0bf56b495688b7b7bfa68e53a9485285a3b1dd9df07efd59697c1283017b123399d812d897e3e76c0a0586e2386f46bbf1cfc96f40d57981544863a837f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
6d6f2f08e773d7199470dd08ad5813f8

SHA1
5654a354df578ae26060a4e59ed57ce0307be6cc

SHA256
a032faada5d8d6d6fa2dedd7c1e29934b4a71a4a0b83fb0985d738f94a1a6dda

SHA512
3d3d6be35fd0be4fcca23a8380aa600f05d774e8870563934c89ec1a26f44432f52d265cb87dc446e56b068890a0f251a1af177630fdb0fc9141159f0d91593d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13cf36081f348230e50ef4f9a218636a

SHA1
d1bdda852c14db94f50076c7e9893e7cdb0ae52e

SHA256
7f39fe1e995513d017df4e74562374537bc26c107e5828ac48d964f1ba08e33e

SHA512
9546b47d00eb65db81960854790d8967b7f95fd4f6fe8bd3c316af7156e166ebe50db56db105fd59f39dd01fe772d20a7520916d999ab240c7f5c1193bb0a7d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
db90d65a65d7e2a27225f35ffc6b528f

SHA1
5bdfcf0ede2e781078d1927cba4f885871187f5d

SHA256
f03428f60a88d71ae57cf738dc407607781a89df279f24760a40e622abb9a0c1

SHA512
8d2dd08d9823c313b64b9ef263596124a22a962fe3cc43bd862356d2e977aadf46fd40f3d9946439c74498b940747212bf2c1116754e1d6d513b8ea43c5ae570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5183c957b47b2db7a92d56324d3f6c01

SHA1
204ef312c83b5ac43122be1805bde938cb8408f5

SHA256
34966ddded96d65f9a8f34db7f00ac435452b3b271d228287b0009abf8fe42ff

SHA512
28bb4c67801ec773a5b7079709d5021dcdef45976a6323e7c95a92bc8274648faf8fbb75048ef200e63f8bc6886bef3e03515584bd2767110c9fd8ce1c70431b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3d874cbf2372e29aa7bde5be5e1db4b3

SHA1
a9214d4e1ddfd7f4cbe8fc61f838f9f2a2f2f26f

SHA256
84c9c0c31f068bcdc2258102ef25547073b785cfedc7345f510de21dd6096000

SHA512
8f90c381382b2a95c3ba3fe941429cc70094c92e78668a54ac88ed3e030c14ee7c3ba8ee7f450533456fd1933663b4c300f265da972fc0493aa409cc17b9fe10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62427145e107f5d8cd11d36bc986fdd7

SHA1
0d040b047256806baeb5b4f3e646df708f8c424b

SHA256
bb257f2771ae2b76844509ba398f628ae9f31866c1143893e15565758fd655c4

SHA512
59949a87360925e6d8a33c0189dd3da548efd81c46b669f3dbf56c89ac4a1ecc2c03d93aa9aed88e95ff2506c557f8c1418a78cb50e4d1a421ed032a92ac3c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
22d54816020334e7cdc17df8c2b65ee4

SHA1
9d81a5654b092d48e56be9a88aad998ad91b149a

SHA256
260bea4a09f5b62fdbb3304353e19ad2f7caae96017127fd9963e1d8dc084c6d

SHA512
cd2801c36a1ad5b7deaf3ac7f13954f42f21738180b08f38858118e7605bcfc67d364c960bae34e944b41d2b0f6da5be9615f12ee66a469ad7e01f6dae2b4e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
a5a4ec9022802a665643677d459f713e

SHA1
fa0b7b7d4821c3ca6f5f36b2eb6beaddad42f94e

SHA256
8fb537dbf1aacdd5eb615b92948a38057a3e95b686fe42a30698985618793478

SHA512
4acb2801f1c796b7153e1fc8b2b793f935b02051560c49cb98e7780bc35d74dbcafa3e81c11b12f2382262595fe492ecfff55a149807cb0a8b9dfa5c8c91890b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9afmek3\imagestore.dat

Filesize
6KB

MD5
fa068b50e878b952f9917b852d1f00d3

SHA1
8661683777e440ae1ba638f502affb9f72fc6612

SHA256
e3ed63c042e5f5194dd0a844f74fff1828a5b78bd2b3d70984514f4b9e25da76

SHA512
6200f0d8e82b6af6725d19c348a2bb13f6ac1f78fd321e774729435145e7fe81cce094c1aaea0ece0b1f2af5c1399bd46e16ea2bcea2c057bfa7848631167744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\favicon[1].ico

Filesize
6KB

MD5
72f13fa5f987ea923a68a818d38fb540

SHA1
f014620d35787fcfdef193c20bb383f5655b9e1e

SHA256
37127c1a29c164cdaa75ec72ae685094c2468fe0577f743cb1f307d23dd35ec1

SHA512
b66af0b6b95560c20584ed033547235d5188981a092131a7c1749926ba1ac208266193bd7fa8a3403a39eee23fcdd53580e9533803d7f52df5fb01d508e292b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp

Filesize
138KB

MD5
32616e919cbfc1470055b92d4f13b2e4

SHA1
4f6b61da6b58f2bd652afb4069adab39df16fbc7

SHA256
4208fa971d86a41d864078f95f06be3be4e20f84f15155e31dab9f62125e06a2

SHA512
5274cd1e98bb13eb555b1baea9d30c6d629833ceaf98e257ea7cd4b392d021bf88e05219a15aab715ef6d7c7ea6e212c449bd325ecb52d103deb5451da46bfed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\5892

Filesize
9KB

MD5
3058cc21101d3fbd63147ee1728575bf

SHA1
4d799614ff78ee10026e2b5579b94fd3faba5e36

SHA256
f0a199264383c36c3ac9fca81a9e75b34c7e06dba4d6c626cd7e7de5f85f98b1

SHA512
e22fd560bdb571974539a3d8a784f3c6460025f1f2b494119170a0e40846136e1a9891191a03e4b579bdb373e1a60b6a7b963f6842a449ec03d4b0f0dbb2357a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\safebrowsing-updating\ads-track-digest256-1.vlpset

Filesize
54KB

MD5
4f9ef3d3a71d4cb49e623e3f4b7b1162

SHA1
c2d65973b44b051d043475e9387fa7100514acbd

SHA256
48ae004f3c542ac764dd5a1e894918ec4b250b5c1f7209256c191cae13106b1f

SHA512
f7017204ad37ceedbff4e8b58ab4edac75748d2f36693e59ea9d9157f637d29b53c6405d994ac9fc62712f2574013e95c4817ff49229c78dcc23cac805b13ed7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\thumbnails\5b6e2f721310880715c772170f98e93c.png

Filesize
5KB

MD5
035167745d6380806cf743b230ffc93a

SHA1
ed791f9a284fa971a2e5897c1ca5f3c8896358b9

SHA256
b7ac1819f946d226043d665761f3fd0c801f0d97b212849e38ad9bceef03208f

SHA512
ce34a6152e549c6db364c017b1c06de47d08a894461ad4863dcbc6a0a1d786431e4bdf6458b97da3a847fc17cfa3f99701f4efe1fe1302b8cb08739cccf91560

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCWD93.xml

Filesize
702B

MD5
db4cf112db3e31dd2e43729d7f9a584a

SHA1
bfbe2a5e143719b868067cbbeea91ac8c2e5bd8e

SHA256
ecdd6ba2c231ae65fc17e49cb4ee78959fb152396de4affa8c998a13bafb7975

SHA512
419c85c7788575c10d4f48cdc400afda065733b826ebedd37c7e8b0a410d102454f7237fc9f2befd4c5394d07c65b4ef084aedde8287a71bbe081e2e144cdadd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1543.tmp

Filesize
1KB

MD5
e6608c2fb52eb2be56bc6b8fbe0d9e40

SHA1
d176eea82683ce54eb3ea7eaa1052392b807d8e8

SHA256
e9b6183c3da033fd5f7b63acd64078d141173557ef2512d94cb86c07cb8028d4

SHA512
810852b13635e6501c683d2c7553c6277b494484fa5d3d552f744c52670134ed5934291bace9fcc7878f5803d3cbf09fad85baa835ce6eb1259a39d376921f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES16CA.tmp

Filesize
1KB

MD5
98aeeabeb6289415ce1080789678fa7e

SHA1
c77e80d230d75b5f45a63f707267121ca3d03044

SHA256
c594fe8d34196442f04ed492b6f7b93f0d0502e68347ea719bb7b3a4087642ac

SHA512
47b293feaef747d57f7603e0c1ef47551f644ffde8db79843f171bdb6c543fd80653599b6d70cc13de4b4075ae05728c970254a3a1b9cd8025aeef100b92a280

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1C87.tmp

Filesize
1KB

MD5
17d45f751313376adeb11969dcfddbb7

SHA1
27dccd486dfc3be83a6479f75630a4ca32a0afb9

SHA256
49b2b3559f71e186ab9c99cafcff39ae328ecbf8f9dce5d5329ebad7def301e3

SHA512
9d385fba1d364fbf450a43ebd665ac868c3cce1abed9db59865e7a106860a6332a92a2dde7ad83d72bf719cc85e18c9411414b27f71b87bf3a78b63530e8ef27

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_myzkxvmi.4cl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovnb10ut\ovnb10ut.dll

Filesize
3KB

MD5
d47e3e8792ecf77599ffbb42de1971d0

SHA1
f8c19c23211ddc71f4898feb12b55d037e51c7ff

SHA256
f744a002a1a86319d56080ba34ac626c91d3b3623fbb31e48271e784854c3148

SHA512
8716af33b31144220d6f37b1da96e7898a8bfc582fd1417b65947a19e90bc444f6d28b95e0705f16ddb77e686f271b6e396c21d1b55db51f7c948d2b9068cf5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tkwiygqw\tkwiygqw.dll

Filesize
5KB

MD5
7b25f35bdf4bf665422ac995a36be290

SHA1
ab111d0adf9d19f58338e8aceb7e2b9df2012577

SHA256
f22c6ee4d26e057c2cccd14d0a3e7169ecf3a9557fae457fc6aa5cd22d437a52

SHA512
d4009294f5475e2b14f0a58a2e227b5ae7dc4937232798317077076ec56f8cb3e2385e301dccdeacd787fb03e2d08f939da9873ed8ab29de3c88994d434dff4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zuev3jb1\zuev3jb1.dll

Filesize
9KB

MD5
2c4fc30a362854ff9656c6ad2b4795fa

SHA1
208fa76c45209912da44cd799c555f1335ce339b

SHA256
60cae64ef03360094484d574549610a6dfbfc62ed16cda1eb4feabd19230111e

SHA512
b56473299a1ab498e394098e1aef02ebff2931439eb45a8273b7ccd18691e82baf97ba58c55c38a9190d1c9b2443d88a96e981f969e215991e9d16a2c11fb035

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
86cc0b64e1edbb137a31b38ee88d640f

SHA1
124f4a0f4ea065c0e70a0124e9bc2c1e184c86a3

SHA256
b0fdfdec036a3d9430d58dbd4d6417f08b9eded45a0457746b97b8824b7bdce8

SHA512
d5a30056cd97c49d6df1c1ec561183b1959a6168f92192a59421a60ff162f11bc66d94718f525f0255a75f84b966054108aefd924382546d703c1572d8960153

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
f68674c9052fe5828fa0096c0a9cd699

SHA1
dad1cb85ce1e28d51b58a4d7913dd9d06be5888d

SHA256
2b9c8a5d29033f80625fc95710a07b6c75d4b53e269f3981f1c66ea75450147b

SHA512
cfb4b70d0ee61f7b6fab5093cf9909dc5018e600b1961dfaedc904bb651216456e48fa995a6f7ed1139ed5fdb9d9bb256998fa103fbb84b87b5bd0bbccd242a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
1422042be75067f25c97d6885aea4bbc

SHA1
5d94cbc74994e9fe4b9086bfdc3f78d2248f8167

SHA256
4cf458555c7ce42fbd9d9da0cb8af4699461d6ab8d59bc84cf978a4ee4e347a5

SHA512
c7ec9cfdb9056618e847524057fb49215775d56222f36e5767e08ddf2f0190d8090be53a30d1f65364d212be7317fbe48b5d8cf7cbea17e67e773ffb3df091d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
46a8f8de4643b6f2373cd08f0df04d5f

SHA1
c1b34f2f448a761a0ab740dbf70f23bf2e6225e3

SHA256
d584ada3f362652815426d624ad0e4698c6c0892dad1fc7d613b9d4bc09afe42

SHA512
7d2ec385d49f1de20e3f6513934098b5f98b1288cbad3360f67dbe777b5b3e041cf17c91e277b94c2a768f35b5397c8f96d36feef7153b373bcd5be7f707172a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore.jsonlz4

Filesize
5KB

MD5
67881982af3bce306c411e632767dc2c

SHA1
68c77f0298b1c8ecb18080fbb1e30a8bed899dd2

SHA256
585907c7ddd9d1b10bddffdf937e54b813b0c30ee82ba778fde768cfa91c7cab

SHA512
816b84ad2d4d2d537c66c78ebae7166976763f3490738fc75edd76710df5d84398354796bbc33adf28747f0109f2191aafe95295c769bd4a106a5cbf8fa44e09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++mega.nz\cache\morgue\71\{e05d7d1d-b422-42d2-b440-9546fdf0f747}.final

Filesize
1KB

MD5
3efa9abd92666265dd81c4f4311a96f9

SHA1
41b6b716d67b93555e444cd453f3c6e3f8c9522c

SHA256
5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7

SHA512
5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++mega.nz\idb\3713173747_s_edmban.sqlite

Filesize
48KB

MD5
4ec498955e7541c789f71ee81ef17980

SHA1
23fdae9922dabb4504a4939423b5579fecc5e1a5

SHA256
827dd157ed9b00622a0c8d2bf888c363f47fd354b80b7dd467c7552f09f26ae5

SHA512
a583e736de2df2d61eac6675ea070bf5bee751e74fdacdf85856b7ec9b9772714dff9349e2e280723cbafbfbb805422e809fe5875294bd0c0a27a751db672085

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Desktop\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Users\Admin\Downloads\Palm.exe

Filesize
235KB

MD5
fd0a1cbec40f6bf0236ca9661180bd53

SHA1
f9be7ae121424460ca59f02c605c2dca82dee236

SHA256
f7d27c81fea257d139e1840f188afc5f6125fac05cd0ee007b025f194f02e9f5

SHA512
f9ac332862465d768e02094981f64841bfff785dba43a7f70569d74879e03f8c96e28440ae2e53c62eef9cee5c6deab2d9f44b5b3743a30831d6a193acbf65c4

Download Submit
C:\Windows\TEMP\SDIAG_60068c12-ea21-4504-afea-0cbf9236040f\RS_ProgramCompatibilityWizard.ps1

Filesize
49KB

MD5
edf1259cd24332f49b86454ba6f01eab

SHA1
7f5aa05727b89955b692014c2000ed516f65d81e

SHA256
ab41c00808adad9cb3d76405a9e0aee99fb6e654a8bf38df5abd0d161716dc27

SHA512
a6762849fedd98f274ca32eb14ec918fdbe278a332fda170ed6d63d4c86161f2208612eb180105f238893a2d2b107228a3e7b12e75e55fde96609c69c896eba0

Download Submit
C:\Windows\TEMP\SDIAG_60068c12-ea21-4504-afea-0cbf9236040f\TS_ProgramCompatibilityWizard.ps1

Filesize
16KB

MD5
925f0b68b4de450cabe825365a43a05b

SHA1
b6c57383a9bd732db7234d1bb34fd75d06e1fb72

SHA256
5b1be3f6c280acfe041735c2e7c9a245e806fd7f1bf6029489698b0376e85025

SHA512
012aadec4ed60b311f2b5374db3a2e409a0708272e6217049643bf33353ab49e4e144d60260b04e3ae29def8a4e1b8ada853a93972f703ca11b827febe7725af

Download Submit
C:\Windows\TEMP\SDIAG_60068c12-ea21-4504-afea-0cbf9236040f\en-US\CL_LocalizationData.psd1

Filesize
6KB

MD5
2c81a148f8e851ce008686f96e5bf911

SHA1
272289728564c9af2c2bd8974693a099beb354ad

SHA256
1a2381382671147f56cf137e749cb8a18f176a16793b2266a70154ee27971437

SHA512
409c2e953672b0399987ec85c7113c9154bc9d6ca87cf523485d9913bb0bf92a850638c84b8dc07a96b6366d406a094d32dc62dd76417c0d4e4ae86d8fcb8bbb

Download Submit
C:\Windows\Temp\SDIAG_60068c12-ea21-4504-afea-0cbf9236040f\DiagPackage.dll

Filesize
65KB

MD5
79134a74dd0f019af67d9498192f5652

SHA1
90235b521e92e600d189d75f7f733c4bda02c027

SHA256
9d6e3ed51893661dfe5a98557f5e7e255bbe223e3403a42aa44ea563098c947e

SHA512
1627d3abe3a54478c131f664f43c8e91dc5d2f2f7ddc049bc30dfa065eee329ed93edd73c9b93cf07bed997f43d58842333b3678e61aceac391fbe171d8461a3

Download Submit
C:\Windows\Temp\SDIAG_60068c12-ea21-4504-afea-0cbf9236040f\en-US\DiagPackage.dll.mui

Filesize
10KB

MD5
d7309f9b759ccb83b676420b4bde0182

SHA1
641ad24a420e2774a75168aaf1e990fca240e348

SHA256
51d06affd4db0e4b37d35d0e85b8209d5fab741904e8d03df1a27a0be102324f

SHA512
7284f2d48e1747bbc97a1dab91fb57ff659ed9a05b3fa78a7def733e809c15834c15912102f03a81019261431e9ed3c110fd96539c9628c55653e7ac21d8478d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ovnb10ut\CSCA07E79367E8E470AA83B1371C3386E30.TMP

Filesize
652B

MD5
3c15df8ff64a9657f4c9e618438c49ab

SHA1
48cecc38e1be14e3fb8240085e109f8777590faa

SHA256
1370d33283ce890774d760afac9a8ba89b63762cc01b8a591d0c6dab8f917951

SHA512
cf47b1bd36310f9ac4d80c68ff5aaefde30f03619a7b03862546237d56636776bafae6dbe88b39a970b866fe1bf236166afd5e5fe0407e2d90376605e6b584ae

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ovnb10ut\ovnb10ut.0.cs

Filesize
791B

MD5
3880de647b10555a534f34d5071fe461

SHA1
38b108ee6ea0f177b5dd52343e2ed74ca6134ca1

SHA256
f73390c091cd7e45dac07c22b26bf667054eacda31119513505390529744e15e

SHA512
2bf0a33982ade10ad49b368d313866677bca13074cd988e193b54ab0e1f507116d8218603b62b4e0561f481e8e7e72bdcda31259894552f1e3677627c12a9969

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ovnb10ut\ovnb10ut.cmdline

Filesize
356B

MD5
4353ca495c1bb8e7acafcbf82be3ffe2

SHA1
c684611cd69e3cf267e7f5c1b4d976ef1c56574f

SHA256
7ca766883a7d21a6e71319d5204059f8367d61cc2362d3a2dd9cefb1318c8343

SHA512
cefce62fb7422ac318b507cdb31c8c7fed5a5cf3335e09c499cbf796a37a8af060a5d5c4a857fa2eaed22f1237267927352a5972c5f988fee9abd2a326e0dd4e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkwiygqw\CSC8017872976264C5089F54C25EF3D4CB8.TMP

Filesize
652B

MD5
2dbd0f5d2d580caedc39a6041a6404d1

SHA1
2fcdffb2517b7942525c12748121182bb226ac18

SHA256
16227d589ffe318cbbbc040836417b8fe51100d38bba8fe1ef93918e4a8c8b95

SHA512
335d443242acac7ab26b56a8377012033cde1e4d8771b5ee5ed898a2168941e4ae4a9203b24938d4a259cc82663a91dc325470ae231322e4d520bcd3074c8bb6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkwiygqw\tkwiygqw.0.cs

Filesize
5KB

MD5
fc2e5c90a6cb21475ea3d4254457d366

SHA1
68f9e628a26eb033f1ee5b7e38d440cfd598c85d

SHA256
58fcc3cfb1e17e21401e2a4b2452a6e5b8a47163008b54fdcdcc8cadff7e5c77

SHA512
c54b9ce28fa71d7e3629cdd74ac9f23cba873506f1b5825acc2aa407414ed603af4c846dcf388c579f8324e3538e63b26f90421ea9d7fcdd3b277c21bad1a5b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkwiygqw\tkwiygqw.cmdline

Filesize
356B

MD5
e27bcba5753349932911b4dacaeca865

SHA1
f3452b7ec6da66c0efbf26a645704b2015c3fbca

SHA256
dca9624b91ae031a17c9e5ccc67bc33c524544ccc1927e0a798886ccb9eac961

SHA512
3c158adba1709496a6f685d9df166cf073255abc5a74f7ab6b92ac577949d4dfaf91e6cdb63777dbdf800b3eec217bfb366dcde1400d5727c13e129269986330

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zuev3jb1\CSCEF219620EE0C4E09A0D9DF385F92297.TMP

Filesize
652B

MD5
31096201a3af5a760724f9410be6503c

SHA1
26937bb09810aedd9fd2bd4261182933daff22f8

SHA256
9d73756f7b65cc1f819b5b135c1d9395a4d5f7d4181112b70e809f1d741ab8d4

SHA512
41a9de0f29897466b17b545dadad0a00e9fd3775f8c99d94665b00fe0a1bac5f5e5f0393fa89fc7ed056e49a3f6e1c6a2145a010fb0b855228a01bc3db3d5f3b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zuev3jb1\zuev3jb1.0.cs

Filesize
11KB

MD5
acf1a7b8aab4c6efda423d4842a10a85

SHA1
ac55b84b81527ad1224a85640c5a2555b19b685d

SHA256
af0a7036a5f650570990f2d562a7c7636b6eaa54f53b6ce3f43aaa070188dafa

SHA512
22e5a8b633a0189e836adb0c34c84b5029e8069e2f0a77803da91ce2b0da14b8fa231ddd1f1b164992d534b8a4ccc51c270e8ff2ff3f2f34536432b4abfc04e5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zuev3jb1\zuev3jb1.cmdline

Filesize
356B

MD5
1e79ad127959daffc77c6f4184529152

SHA1
5f16d46bec6553c5836cf8138080042ff071b18a

SHA256
0d581cc9d4963be47d12dc23e4b2a4a6e2fa4c4eb6f8c0ab1575e4f0fe8cda4e

SHA512
00520cb72e9d246531ced95216311c6b60b45a7a0f866939b2002d845dee831566835deb69d61b56441a7902006589c463592ccf6e68072a5e9eaafb218d7e86

Download Submit
memory/2912-1006-0x000001F8FBC20000-0x000001F8FBC30000-memory.dmp

Filesize
64KB

Download
memory/3636-765-0x000001AB36360000-0x000001AB36370000-memory.dmp

Filesize
64KB

Download
memory/4196-720-0x0000019C3DBB0000-0x0000019C3DBD2000-memory.dmp

Filesize
136KB

Download
memory/4196-767-0x0000019C3BD20000-0x0000019C3BD30000-memory.dmp

Filesize
64KB

Download
memory/4196-766-0x0000019C3BD20000-0x0000019C3BD30000-memory.dmp

Filesize
64KB

Download
memory/4196-719-0x0000019C3BD20000-0x0000019C3BD30000-memory.dmp

Filesize
64KB

Download
memory/4196-761-0x0000019C3BD20000-0x0000019C3BD30000-memory.dmp

Filesize
64KB

Download
memory/4364-1021-0x00000201FA8B0000-0x00000201FA8C0000-memory.dmp

Filesize
64KB

Download
memory/4504-772-0x000001CFEA460000-0x000001CFEA470000-memory.dmp

Filesize
64KB

Download
memory/4996-773-0x00000290FF3A0000-0x00000290FF3B0000-memory.dmp

Filesize
64KB

Download
memory/5152-572-0x000001C97F190000-0x000001C97F1A0000-memory.dmp

Filesize
64KB

Download
memory/5852-552-0x0000018E665E0000-0x0000018E66620000-memory.dmp

Filesize
256KB

Download
memory/5852-553-0x0000018E683D0000-0x0000018E683E0000-memory.dmp

Filesize
64KB

Download
memory/5968-562-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-561-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-566-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-564-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-556-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-557-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-555-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-565-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-567-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/5968-563-0x0000024764300000-0x0000024764301000-memory.dmp

Filesize
4KB

Download
memory/6056-815-0x00000276563F0000-0x0000027656400000-memory.dmp

Filesize
64KB

Download
memory/6056-570-0x000002A33DCD0000-0x000002A33DCE0000-memory.dmp

Filesize
64KB

Download