0bc90706defe0f5defbc5be90ea4d4c14ec01ad3b85ac35baa4db1b9906bcad6

Analysis

max time kernel
1s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WEXTRACT.exe
Size 3.7MB
Sample240105-gtqvpsedgr
SHA256 0bc90706defe0f5defbc5be90ea4d4c14ec01ad3b85ac35baa4db1b9906bcad6
MD5 328fd7982434a7461238a8d884c3cf4c
SHA1 56dd9e9f55888f4b866c5f72dac7693c4c43a922
SHA512 361609ba5a9fee8c6f1c0f637ba3eae381777b6b26b7969fbc9722f14f23f7b95c201c1c495557c2283e844553d96bdf5957f3163eb53f2b7738f7227933ca02
SSDEEP 98304:33kEcRU7TlFw5pHdCzcGgWN7J4r9oVMRJOE35:33k+HlGAxfN7Y0MRb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4728	zy9NP42.exe
2408	MY6Wi92.exe
3664	1OJ96lj2.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEXTRACT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zy9NP42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	MY6Wi92.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023240-20.dat	autoit_exe
behavioral2/files/0x0007000000023240-19.dat	autoit_exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6072	schtasks.exe
5396	schtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3664	1OJ96lj2.exe
3664	1OJ96lj2.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3664	1OJ96lj2.exe
3664	1OJ96lj2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4728	1408	WEXTRACT.exe	21
PID 1408 wrote to memory of 4728	1408	WEXTRACT.exe	21
PID 1408 wrote to memory of 4728	1408	WEXTRACT.exe	21
PID 4728 wrote to memory of 2408	4728	zy9NP42.exe	24
PID 4728 wrote to memory of 2408	4728	zy9NP42.exe	24
PID 4728 wrote to memory of 2408	4728	zy9NP42.exe	24
PID 2408 wrote to memory of 3664	2408	MY6Wi92.exe	22
PID 2408 wrote to memory of 3664	2408	MY6Wi92.exe	22
PID 2408 wrote to memory of 3664	2408	MY6Wi92.exe	22

C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe
"C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zy9NP42.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zy9NP42.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MY6Wi92.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MY6Wi92.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2al3504.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2al3504.exe
      4⤵
      PID:5064
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3rm15HU.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3rm15HU.exe
    3⤵
    PID:5220
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      PID:5756
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      PID:5436
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:5396
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      PID:6036

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OJ96lj2.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OJ96lj2.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffceda46f8,0x7fffceda4708,0x7fffceda4718
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6540 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8503478593992057948,10344256818253239465,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 /prefetch:2
    3⤵
    PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://facebook.com/login
  2⤵
  PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fffceda46f8,0x7fffceda4708,0x7fffceda4718
1⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8899227980108616576,12899407051112801966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8899227980108616576,12899407051112801966,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
1⤵
PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,13060108104135831163,4606129679190039694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
1⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,13060108104135831163,4606129679190039694,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
1⤵
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffceda46f8,0x7fffceda4708,0x7fffceda4718
1⤵
PID:4360

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:5132

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
1⤵
- Creates scheduled task(s)
PID:6072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x424 0x504
1⤵
PID:5180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

519ba2c4-3732-42fd-a8be-aac9c7de6bff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\519ba2c4-3732-42fd-a8be-aac9c7de6bff.tmp
Size 2KB
SHA256 5298246e92fe2dc6e0af59cd9687dd4c741e492394a4c70b9410576b97d3ddb7
MD5 79c63a7de74e5891e4d3deff5be795ae
SHA1 f0be09525b8af3c28a37ea9883356ddaae31c2f5
SHA512 52db35b40b58c233be71e0a93bcdeecd7b1150575fe725b55109e0a85f51f4543482e0d860b3b7e5bebd466a6f6442b0ecc575e5276d57182fa7b45432cdc9b9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfaf6313fd293f6013f58fb6790fd38ca2f04931403267b7a6aef7bfa81d50bb
MD5 8a1d28b5eda8ec0917a7e1796d3aa193
SHA1 5604a535bf3e5492b9bf3ade78ca7d463a4bfdb2
SHA512 51b5bec82ff9ffb45fee5c9dd1d51559c351253489ea83a66e290459975d8ca899cde4f3bb5afbaa7a3f0b169f87a7514d8df88baaeec5bd72d190fd6d3e041b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
MD5 1386433ecc349475d39fb1e4f9e149a0
SHA1 f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA512 fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e3fe758b8c0245bf2913ac23e1fac104a15c0f3e6433c04d56ea915c47b79716
MD5 ee0bfaa54f626f5737fea5e4f3ddeebc
SHA1 e1d5f3b2b1837472e7f47558d420fb0bd058bb41
SHA512 1d82120b301efa980d74f4303aecf36c2c51d6040bb9feb9c51d1bdd18e62c9de0710c9c177ba61c28127d0315775a5044fb60ad45a930d80eac650e531fd5ad
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c2808d113c4e9f53485e5478ae5d117204f95baff4587f3639a1ca501b1e678c
MD5 a77e931ccfa63cd55b35d135ec315996
SHA1 20b1f86c243214dd0fd2f7a4fd0fd4c2b46d95b7
SHA512 734181638442f7a0877da4e3a71e0078d8ad345d3b965d7e6c582f9710d8916d324df22a8b222bc30a9d5ef178c960788d5a207b902bfaf9b7adf805b5942072
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a9022c39ecc7367519b3259108ea944a6efd6965ff27e7f1aac7009cd21e4235
MD5 98dca6843ec7301f487f3b56a1b649c9
SHA1 e9549c6b85d7e0c2b9e9c5b1705d4a18076268a4
SHA512 10e4301126b68975bd3b973e670fe31e5ac492f4883e31e47fa5ad2e7ae2a83d816d24d2f32fc5cb16fde41bf59799f23e233878c2b61b3e2a5c3a4d2da3681a
SSDEEP 96:nwkfm1n/aO5wpvWMoiVmdeH8P8+UWQyV+VDCzia:nwkuFt5GWMXe8+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 2KB
SHA256 49ece2ae5b07c2f0654dc21868b6b2e5deb2ffbd4b8f9d56da3d700d0b3a6ba0
MD5 3aec917fdd9caae8eea886ff0f3ac8a8
SHA1 acf235e9bb355aad8f12b144a68e88cc00772271
SHA512 88c56dd6dd278d629154b2c29d6a8fe3385f1b209fdb2c510c40b9d3c52008db05bf77da760fd01d585b0f974c6118f5ab4f17de7ca40a584950656c10aa0167
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 20KB
SHA256 8dc5ed858cbffe27ccd9f287d3770b19afd2367065e48c790d8342668c11ca47
MD5 4ea58cdac4c7d778e86b08af7dedcf93
SHA1 a26e646380a2b21b2354608ad0208e67dc6e0316
SHA512 c59610fe2afa107d160414dcd32a6d1f376578496c0cbaad15281f7bd095b4850666a52805670b580dbad2e43ef188af855452245dd7cfc1ee953056835c2ca0
SSDEEP 384:n/+fCtHFxKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvLlz9mIT:n/MWlx8F1+UoAYDCx9Tuqh0VfUC9xbov
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca87b46c-e95f-4d3c-83fd-57ca802b1801\index-dir\the-real-index
Size 2KB
SHA256 7733f1e8bc85023db809885409ed0f3fa8e47aae91fac7708a1e6bdd15068893
MD5 c1ecc5f79c9867c9a6f3683bbc9ae997
SHA1 54c74ace9fd12ba021e5b40e4845bd5e882e00d0
SHA512 a5a7a5bc3aa7e2ac1c5fb58f9ee9bb3605457109385ce920897c0e38fbfd5cbeadf42d3ce44674301404b242197f0dff35952c4303b48d5d60f03e80286c8560
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d745.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca87b46c-e95f-4d3c-83fd-57ca802b1801\index-dir\the-real-index~RFe57d745.TMP
Size 48B
SHA256 871527f9a9956e06ef2cae67b648622ed217c381fcdfb7bfe692b67288a5238a
MD5 9bf05d5d28f9a3ada023db6f186f6739
SHA1 f5121fad7485930b293fccc7649a7e3e6d38033a
SHA512 2519c9f83cfabaae21da691219a33cd00e30172174e6e049319a396535feb94e3f8bec07686343a1acfc43646b23123e455aa544b1fd118f4ee4d34c97b329db
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 f77316d4c8511668374819e2363b89d2d3cdf3bba150fd2755d8db0c0537d426
MD5 0ed582129b332c03498b6f8b22c6aeb7
SHA1 ad0e89502a53ac38f28d74a28b0d065ea28e0372
SHA512 a3e8429dcc0fbd05d99ddab810f910f1fc8255bc1e3e86becc127a41c6d16b6df0e38e76bd876f487ab941cb93e7f2875567dbd4c1cb69d07c1656d6a15a1b39
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 84B
SHA256 a75053d0909c1b28f4ff93b2940a9c3a4453c385827acf0d0fa3faadd2dc7381
MD5 6b997fe387f7170756cca58541130b8b
SHA1 2b444883de9c3432a47e612ac08a9d20aa539e00
SHA512 cf4e86327dbb016dd0cd04eb3c93a06a30c37419cab024e9944e1c72d1a9745210e64c807dc750f9a2ceb263507de337abf41767ef2e6638035f259bdbce126f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 037e8606e61faed9b4fdd9025ad4f5a7449aedef81066b71a7d853c449c713e9
MD5 2d7f596b0de9c6fd41a5ddf2dd9697e9
SHA1 6580a7652575d02987fee2ba18f593f7d3f20026
SHA512 1f49ec0d01db82b934bc46eae4397f86ef78b05242a9563e87bfa72dae525490b757b3401380a389ee0c98ff1d8ef617732c896fbff4b8a36924efdc3bbbffb1
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 637cf8e7bc8b2575a0116a1bef7e3564df56aa4d832fe22d892ac9805cf63f4c
MD5 fffde1e256855ffd27d267f92898cc69
SHA1 1a08a65de22fcfe06359455528c337c1254fa4ea
SHA512 bbe1a5d325d763d727cdba2201f1c515500d204541d6210a0d0b1e84d2caa6d0edbc8c95132cb678b65e100334a83a18ad7a451a4bd52d116a172cd0d77f55a6
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d050.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d050.TMP
Size 48B
SHA256 ca4d3e6da0df1faa58fa639f38d4b9ac3ae9383a75e4550e22c3812c9a128a6e
MD5 e6b796bc1d055e81751196bc531f24a8
SHA1 bbbb94605b5dcea35ee1f9d8f8a66f2b48d8c6fe
SHA512 8ef90658b83802d804efc132349fc4027604c59378dcd5bf01696ffed2773f3f626f2c8428035b08c92efb77760c3688f0d197ecfce499faed0f7b4983e30c6a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d7b373ec0c468ebfc3caef8635c385dc87b05053c21d8b1ffad2d9ea4ef37c82
MD5 59c726c7e41c6314f7982a8fb54f188e
SHA1 1506d4c4f7b3c4d7b059c63d12697bc3d23503c5
SHA512 06ae46c334b9bf6c036545102c6efe81be2d5903266a7b6eb8e4cb7010abfe8f058429c02b6d481ce6f8f91b2f445e01d1c0e9593ae77e02f1e7a4d928c785b1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a19f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a19f.TMP
Size 1KB
SHA256 d7406da134f14ad244b54f72dcc9dbb54d34ded34c8f647702fc4c17554c2cb6
MD5 20bf807e1d54624f8046b8566759d7b0
SHA1 5a17c1d0d6037f0716a012f8aebacae24f74e0ae
SHA512 d3d09eea977baa92d499b231161a2653a2f8bf115a1a6bb6b7925e3cc55b63758cd1fc3dd0d14756e5b186b2db729e55e75c768d3d16140bc6028dacdb363373
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 eb352d79fbfe1d9f5f0295d818838cd0f90cc7bf80355ed4d5b09fe141fea2ff
MD5 7442eddd121f7f02013fe98ba05e31f6
SHA1 9ea994e04ab206614520fb0ba222f8b04bd7413d
SHA512 ae906340802c2a51a3adb74e031e4d9e1b027e8f9cf3752cfbb8abda221813025dd7627fe4b46781dfa9eb6e1b5cda644d1a9baf335f0a966f8f8ebd5b930f42
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 1KB
SHA256 beb3471196744ef78599a0139b3677e0bfd2305afd5c734138e06492dd531bb1
MD5 44b0d51b6c40569cdd441386f4304719
SHA1 6d9f9c2d6a069fc3aa76191b031bf9c98d9a8344
SHA512 41ad9d14fcf007221823c659107d40aeda3f810719ad99d18cd27288a6620425e3c8fd68820d3d557bdcbb58e1e5f06701cc2c0d42325146f82385701080b12d
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6fe5563acbfbe46e12f01ece7603c50deccfa684d9bf3f835d1fbb1dbdcfd1de
MD5 4fb67390e0c5e484b3ce3a376ce5cc24
SHA1 f3315f9f86d712201f3e12d1f39e6967d9c4ea99
SHA512 ebf98b0d057be07a7c34cff47b7fc21e3a840b8f02170e863d50b068b5f2abd60747b9485c05964c9b2468041496d08dd4f3932712eb62c18f2392f10e7d2644
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKae2RU8sg8vKEqD38Lk0iz:N9iIxuERzA83h09RZxYK0OFvby38wg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy9NP42.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zy9NP42.exe
Size 19KB
SHA256 393c2b1e0b35602a0e33395e0f34479b1cde1e5fffca52d0433c02fdcf0cf2ab
MD5 5f5adb010630cd13d54fad132281d31e
SHA1 e127c547b3417e25b2719242706b0e49236b1c7b
SHA512 3925ff57958484e03aa4e3631356ddafb1faacc43164ff8cd17867dbafede07a963c196f712476bc58933124ee0f85d79f333f4bff7a44d4f524bbce70416b39
SSDEEP 384:Kn9ZCil2Ba8oP/TXnCYqgEJVJ1CImo/uDYJcE46:Knb98oXTZREcImo/uUGEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy9NP42.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zy9NP42.exe
Size 70KB
SHA256 209407a616c0958eb490793813ed8f5e82e057dd798af35d4385fad40827dfbb
MD5 4544ad83ae2f11501ca350244c8ce576
SHA1 e38b3a23b7864e182e201d1a2bc1138736f60119
SHA512 9f17f00a99d6946c12de6d02c6c70a75adcf554fd889bc6ba9f0fd459dab657e153deb5518ecdeeef4d144c9cda980f6d3752967fbce80e5420baf379180f4e1
SSDEEP 1536:Kb9xXnNImo/ur1ZbLr+O1Ls5g1WdPzE3ROovcK4zqhNCW:K5y+bnr+O1Q5GWp1icKAAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3rm15HU.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3rm15HU.exe
Size 1KB
SHA256 f91a13704ab7bcf7e7c19f2253c7e2b10671b626873afdef440d3edd7adea114
MD5 52014a92319cb55d64c583533aaa070f
SHA1 7c0f80a8387f4c8c15393329b15b9454ab6e1c91
SHA512 261b24a0d7646a615de3960ac23df1ea8ce9c06cc33243c5f20d1e10d1ba54bf515e3622a4210adc59758687d42fd159dafc547ec02196270605d542dd9e1320
MD5 SHA1 SHA512

Submit Download

3rm15HU.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3rm15HU.exe
Size 19KB
SHA256 177ec7642c6b8d3801c15dd677d0e733a60a55b0848c09a86e67582e6ee710b7
MD5 45eceb10e0f0b4aaa694e04440a12b70
SHA1 54e6e76df0a503406b4b3deaba50bc9564f2410a
SHA512 4f9f068dbb2ea988c60c046d5bf695ed0ba1c164d82dc4bcba8e2c0fb7a68dacdf433c30244f8b846af1108d6b2941a2674afe2f854102b8b2311d60a7cd1fae
SSDEEP 384:J3BOvVhNKVYElaTHbanY3NoPhI2B055ARYcn:pBR4IY3A/fRYc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MY6Wi92.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MY6Wi92.exe
Size 42KB
SHA256 81896ae2fb64b717bce8dcb7254d5853d229492af88ce864552d89dcd10a45b4
MD5 11c7a1d967e10bd9fbb00a2c8a34ec1b
SHA1 e503dd18acfd627a8913bd0eedd1ee5f68f2b5ec
SHA512 99e2128b361c4fdd3f0ea136affe1643bc940e564103dd21b72fedda00ca5ba1f18e91e13e9c7ffacb41c9008f47d94c9ad96b421853781c06f79e9f16bbe00c
SSDEEP 768:Khb98oXTZREcImo/uUGE5TANCkZ/mELr+lk4iX1+QRgiSlmmmbeskhx8Hvc5gI04:Kd9xXnNImo/ur1ZbLr+O1fs5go
MD5 SHA1 SHA512 SSDEEP

Submit Download

MY6Wi92.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MY6Wi92.exe
Size 46KB
SHA256 335e13e7af7f907ac166897c89deebd7e2ac0f15dadc81f88b1a1a25a7a33eba
MD5 64d7953ed458d6ac23ebf4257e754962
SHA1 af03bd139e66fcbd636377d033d9d24652f910ea
SHA512 61a1c85db82ed6a1e6bf6bbef3fa6f15b52ab61cdc8220946ba20b461788b9b233f0d0c37a764c0dada7a700d962a6b2978af6065ecc791ac144b5101a8ab37d
SSDEEP 768:Khb98oXTZREcImo/uUGE5TANCkZ/mELr+lk4iX1+QRgiSlmmmbeskhx8Hvc5gI0F:Kd9xXnNImo/ur1ZbLr+O1fs5g1
MD5 SHA1 SHA512 SSDEEP

Submit Download

1OJ96lj2.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OJ96lj2.exe
Size 32KB
SHA256 d315b8b6ab3e405434998a5e766d3320bf495994fc11fb0cc3bdcbde4a69f902
MD5 aec744fe1c4a63e4997e25aab5958d5b
SHA1 03c6dfec7cb10344d24c3dfeadc0bbdf13c52971
SHA512 1d9aadb5f44de8bda93acbea07f92ba19721814e7f5f5515001854d61aa91c46cb2884a29d5cb40c6771e836d4e685394040a3f3d16ca74252a6510a7421728c
SSDEEP 768:1RN/DvXlBxuaF8bKLSBVIFA/ZA6A+3jL/sXNumG3buQjv:1XTXlBkaF9SoSZs+zIX43v
MD5 SHA1 SHA512 SSDEEP

Submit Download

1OJ96lj2.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OJ96lj2.exe
Size 10KB
SHA256 02638b1b5a1226a9d743afc0372195e54150c83f33e58ac443e61f8dcb405a45
MD5 e1b7e983fa4800ea2b6c26d4fbefa3fa
SHA1 20c927f54177071ab09b38e5e478305743418424
SHA512 1d2507f1d13d1d24f5989fe5d5a7ae3971e879a79229d80db556060bf4e920c1108b7f447cc8e1ebc4f8007cd3c286a697b734a236786df34b82d193ef6b08f2
SSDEEP 192:1/P/+x4dJO0/66Ds1kFBXESi0XvXf9BfZe3vEAsTbRms1IAKQwGQMBmi1TmvNr1P:13DtN/xVvXlBfZe3QPAKIRGF8vNJPZB
MD5 SHA1 SHA512 SSDEEP

Submit Download

2al3504.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2al3504.exe
Size 66KB
SHA256 67360d11869832a1c03045dd3c1e8fc7e03c239ed3a3117138e96d33ee6ebfcd
MD5 eb89978cd2cfef4812345ff471ddf760
SHA1 bba753ddb128eb3629684a8dce0563961f938efc
SHA512 677ad6d1925f83ba6274e0ed2bdb77b8af75f01bf999f9489f6d79731b11dd60cec97b0347c2b77f5f6b5609aa2bc25a2af80072ef405b82e105491693f62a75
SSDEEP 1536:qQaroKQHVZa9YnfLndZ3b/wV1qDkvvwnL1DA0pYAhv5emk20RvmHmogO9:qQasD1ZaoTndZFWGpE0Phv5l3rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_bqdvujh4.y3s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bqdvujh4.y3s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/5064-123-0x0000000004C00000-0x0000000005000000-memory.dmp

Download

memory/5064-134-0x0000000076D70000-0x0000000076F85000-memory.dmp

Download

memory/5064-124-0x0000000004C00000-0x0000000005000000-memory.dmp

Download

memory/5064-45-0x0000000077A72000-0x0000000077A73000-memory.dmp

Download

memory/5064-122-0x0000000004C00000-0x0000000005000000-memory.dmp

Download

memory/5064-131-0x00007FFFED110000-0x00007FFFED305000-memory.dmp

Download

memory/5064-138-0x0000000000400000-0x000000000081A000-memory.dmp

Download

memory/5064-39-0x0000000000400000-0x000000000081A000-memory.dmp

Download

memory/5064-132-0x0000000004C00000-0x0000000005000000-memory.dmp

Download

memory/5132-149-0x0000000002920000-0x0000000002D20000-memory.dmp

Download

memory/5132-135-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

Download

memory/5132-142-0x0000000002920000-0x0000000002D20000-memory.dmp

Download

memory/5132-143-0x0000000002920000-0x0000000002D20000-memory.dmp

Download

memory/5132-144-0x00007FFFED110000-0x00007FFFED305000-memory.dmp

Download

memory/5132-152-0x0000000002920000-0x0000000002D20000-memory.dmp

Download

memory/5132-148-0x0000000076D70000-0x0000000076F85000-memory.dmp

Download

memory/5220-595-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-634-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-589-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-164-0x00000000089C0000-0x0000000008A36000-memory.dmp

Download

memory/5220-623-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-633-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-546-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-579-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-635-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-525-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-153-0x0000000077A72000-0x0000000077A73000-memory.dmp

Download

memory/5220-161-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-489-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-636-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-150-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5220-639-0x0000000000EB0000-0x000000000131C000-memory.dmp

Download

memory/5756-224-0x00000000070D0000-0x0000000007173000-memory.dmp

Download

memory/5756-165-0x0000000004910000-0x0000000004946000-memory.dmp

Download

memory/5756-166-0x0000000005010000-0x0000000005638000-memory.dmp

Download

memory/5756-169-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/5756-170-0x0000000005640000-0x0000000005662000-memory.dmp

Download

memory/5756-242-0x0000000073B10000-0x00000000742C0000-memory.dmp

Download

memory/5756-235-0x0000000007430000-0x000000000743E000-memory.dmp

Download

memory/5756-237-0x0000000007540000-0x000000000755A000-memory.dmp

Download

memory/5756-238-0x0000000007520000-0x0000000007528000-memory.dmp

Download

memory/5756-236-0x0000000007440000-0x0000000007454000-memory.dmp

Download

memory/5756-234-0x0000000007400000-0x0000000007411000-memory.dmp

Download

memory/5756-231-0x0000000007480000-0x0000000007516000-memory.dmp

Download

memory/5756-210-0x0000000007090000-0x00000000070C2000-memory.dmp

Download

memory/5756-228-0x0000000007270000-0x000000000727A000-memory.dmp

Download

memory/5756-211-0x0000000074920000-0x000000007496C000-memory.dmp

Download

memory/5756-226-0x0000000007200000-0x000000000721A000-memory.dmp

Download

memory/5756-225-0x0000000007840000-0x0000000007EBA000-memory.dmp

Download

memory/5756-221-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/5756-223-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/5756-188-0x0000000005880000-0x0000000005BD4000-memory.dmp

Download

memory/5756-222-0x00000000064B0000-0x00000000064CE000-memory.dmp

Download

memory/5756-209-0x000000007EE50000-0x000000007EE60000-memory.dmp

Download

memory/5756-171-0x00000000056E0000-0x0000000005746000-memory.dmp

Download

memory/5756-167-0x0000000073B10000-0x00000000742C0000-memory.dmp

Download

memory/5756-168-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download

memory/5756-196-0x0000000005EF0000-0x0000000005F3C000-memory.dmp

Download

memory/5756-195-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

Download

memory/5756-172-0x0000000005750000-0x00000000057B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads