5d0ee5f845eaa035d53514e4435c33deec179230ee95cad356f5f4a824c08108

Resubmissions

19/02/2024, 20:09

240219-yxk73acc2v 6

19/02/2024, 20:09

240219-yw5v3scb9t 3

Analysis

max time kernel
48s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quarantine.exe
Size

158KB
MD5

d72dfb79a9fa73dd4c514c61ea459e0a
SHA1

e6e1d03bf41eca58812bf206e7a1c225ea742dad
SHA256

5d0ee5f845eaa035d53514e4435c33deec179230ee95cad356f5f4a824c08108
SHA512

a5d7bdb91434a2be030e9c2141c72f83acd5442f18166effd1e554a0435e67a58a2101fd07b6e75d3bc3aec45e387aa8b3cec84bcefbe182c746780198b9e731
SSDEEP

3072:JB/umH8RI2mBPX42UeGwiiiiih6666J66666eB2yUii9iiFPckuony:JlZ2qiiiiih6666J66666ekyUii9iiED

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
68	whatismyipaddress.com
69	whatismyipaddress.com
70	whatismyipaddress.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3803511929-1339359695-2191195476-1000\{8AD1D128-67D1-4640-BB5C-3D533F657E2B}	msedge.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
4484	PING.EXE
3104	PING.EXE
2516	PING.EXE
1640	PING.EXE
2396	PING.EXE
2792	PING.EXE
4856	PING.EXE
348	PING.EXE
4600	PING.EXE
3180	PING.EXE
4836	PING.EXE
3580	PING.EXE
2396	PING.EXE
1340	PING.EXE
4908	PING.EXE
392	PING.EXE
3596	PING.EXE
2508	PING.EXE
5088	PING.EXE
3640	PING.EXE
3476	PING.EXE
2920	PING.EXE
2600	PING.EXE
2324	PING.EXE
4240	PING.EXE
1412	PING.EXE
3488	PING.EXE
2516	PING.EXE
3152	PING.EXE
3996	PING.EXE
3228	PING.EXE
4956	PING.EXE
2464	PING.EXE
2128	PING.EXE
4704	PING.EXE
3176	PING.EXE
4820	PING.EXE
1536	PING.EXE
1340	PING.EXE
4976	PING.EXE
2112	PING.EXE
804	PING.EXE
4824	PING.EXE
4992	PING.EXE
1392	PING.EXE
2460	PING.EXE
1504	PING.EXE
4464	PING.EXE
4432	PING.EXE
2176	PING.EXE
3548	PING.EXE
3316	PING.EXE
4764	PING.EXE
3220	PING.EXE
4668	PING.EXE
1292	PING.EXE
4932	PING.EXE
1652	PING.EXE
316	PING.EXE
4604	PING.EXE
4440	PING.EXE
468	PING.EXE
1960	PING.EXE
2792	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
2288	msedge.exe
2288	msedge.exe
1412	msedge.exe
1412	msedge.exe
2932	identity_helper.exe
2932	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3068	1036	Quarantine.exe	85
PID 1036 wrote to memory of 3068	1036	Quarantine.exe	85
PID 3068 wrote to memory of 1020	3068	cmd.exe	86
PID 3068 wrote to memory of 1020	3068	cmd.exe	86
PID 3068 wrote to memory of 5088	3068	cmd.exe	88
PID 3068 wrote to memory of 5088	3068	cmd.exe	88
PID 3068 wrote to memory of 2736	3068	cmd.exe	89
PID 3068 wrote to memory of 2736	3068	cmd.exe	89
PID 3068 wrote to memory of 2088	3068	cmd.exe	95
PID 3068 wrote to memory of 2088	3068	cmd.exe	95
PID 3068 wrote to memory of 2608	3068	cmd.exe	97
PID 3068 wrote to memory of 2608	3068	cmd.exe	97
PID 2088 wrote to memory of 1472	2088	cmd.exe	98
PID 2088 wrote to memory of 1472	2088	cmd.exe	98
PID 2088 wrote to memory of 4668	2088	cmd.exe	99
PID 2088 wrote to memory of 4668	2088	cmd.exe	99
PID 2088 wrote to memory of 4488	2088	cmd.exe	100
PID 2088 wrote to memory of 4488	2088	cmd.exe	100
PID 2088 wrote to memory of 2516	2088	cmd.exe	101
PID 2088 wrote to memory of 2516	2088	cmd.exe	101
PID 2088 wrote to memory of 4472	2088	cmd.exe	102
PID 2088 wrote to memory of 4472	2088	cmd.exe	102
PID 2088 wrote to memory of 1340	2088	cmd.exe	103
PID 2088 wrote to memory of 1340	2088	cmd.exe	103
PID 2088 wrote to memory of 4152	2088	cmd.exe	104
PID 2088 wrote to memory of 4152	2088	cmd.exe	104
PID 2088 wrote to memory of 2176	2088	cmd.exe	105
PID 2088 wrote to memory of 2176	2088	cmd.exe	105
PID 2088 wrote to memory of 2344	2088	cmd.exe	106
PID 2088 wrote to memory of 2344	2088	cmd.exe	106
PID 2088 wrote to memory of 2792	2088	cmd.exe	107
PID 2088 wrote to memory of 2792	2088	cmd.exe	107
PID 2088 wrote to memory of 1164	2088	cmd.exe	108
PID 2088 wrote to memory of 1164	2088	cmd.exe	108
PID 2088 wrote to memory of 4240	2088	cmd.exe	109
PID 2088 wrote to memory of 4240	2088	cmd.exe	109
PID 2088 wrote to memory of 2052	2088	cmd.exe	110
PID 2088 wrote to memory of 2052	2088	cmd.exe	110
PID 2088 wrote to memory of 3180	2088	cmd.exe	111
PID 2088 wrote to memory of 3180	2088	cmd.exe	111
PID 2088 wrote to memory of 3164	2088	cmd.exe	112
PID 2088 wrote to memory of 3164	2088	cmd.exe	112
PID 2088 wrote to memory of 2396	2088	cmd.exe	113
PID 2088 wrote to memory of 2396	2088	cmd.exe	113
PID 2088 wrote to memory of 2636	2088	cmd.exe	114
PID 2088 wrote to memory of 2636	2088	cmd.exe	114
PID 2088 wrote to memory of 1412	2088	cmd.exe	115
PID 2088 wrote to memory of 1412	2088	cmd.exe	115
PID 2088 wrote to memory of 1984	2088	cmd.exe	116
PID 2088 wrote to memory of 1984	2088	cmd.exe	116
PID 2088 wrote to memory of 4876	2088	cmd.exe	117
PID 2088 wrote to memory of 4876	2088	cmd.exe	117
PID 2088 wrote to memory of 2760	2088	cmd.exe	118
PID 2088 wrote to memory of 2760	2088	cmd.exe	118
PID 2088 wrote to memory of 468	2088	cmd.exe	119
PID 2088 wrote to memory of 468	2088	cmd.exe	119
PID 2088 wrote to memory of 4312	2088	cmd.exe	120
PID 2088 wrote to memory of 4312	2088	cmd.exe	120
PID 2088 wrote to memory of 4484	2088	cmd.exe	121
PID 2088 wrote to memory of 4484	2088	cmd.exe	121
PID 2088 wrote to memory of 1264	2088	cmd.exe	122
PID 2088 wrote to memory of 1264	2088	cmd.exe	122
PID 2088 wrote to memory of 2324	2088	cmd.exe	123
PID 2088 wrote to memory of 2324	2088	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
"C:\Users\Admin\AppData\Local\Temp\Quarantine.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4297.tmp\Quarantine.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\system32\mode.com
    mode con lines=20 cols=70
    3⤵
    PID:1020
- - C:\Windows\system32\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:5088
- - C:\Windows\system32\mode.com
    mode con lines=25 cols=100
    3⤵
    PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K ConnectionT.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\system32\mode.com
      mode con lines=10 cols=49
      4⤵
      PID:1472
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4668
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4488
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2516
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4472
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1340
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4152
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:2176
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2344
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2792
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1164
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4240
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2052
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3180
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3164
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2396
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2636
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1412
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1984
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:4876
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2760
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:468
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4312
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4484
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1264
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2324
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1840
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3104
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1260
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3548
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2892
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4856
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4460
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3228
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4552
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4908
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1948
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:1808
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3804
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4440
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4428
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1292
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4888
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:348
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3864
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:3696
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1020
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1960
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:632
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4824
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:824
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1536
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2544
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:5084
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1144
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4932
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1464
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3316
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:536
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3176
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2296
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2516
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4452
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1340
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1372
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2176
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4516
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:336
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2792
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4656
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:4240
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3164
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4992
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3152
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2636
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1392
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1604
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3996
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1236
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:392
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4476
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1652
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:512
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4764
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1240
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2460
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4972
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3640
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4412
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3476
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1964
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:2320
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3576
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3220
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4908
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:316
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1808
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1504
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4440
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4956
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1292
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4976
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:348
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:2288
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3696
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2112
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1960
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4600
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4824
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:2836
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1536
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4836
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:5024
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2464
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4932
- - C:\Windows\system32\mode.com
    mode con lines=25 cols=100
    3⤵
    PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K Pinger_Q.Bat
    3⤵
    PID:4472
  - - C:\Windows\system32\mode.com
      mode con lines=20 cols=62
      4⤵
      PID:3980
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:4112
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:932
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:1640
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1584
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2128
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1580
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2396
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2520
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4820
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3876
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2764
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3596
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4464
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3120
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3488
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:392
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      PID:2324
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1652
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2920
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4488
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:3580
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:1260
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2600
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3640
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:804
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4460
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4604
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:4552
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:2508
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:640
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4432
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:3460
  - - C:\Windows\system32\PING.EXE
      PING -n 1 1.1.1.1
      4⤵
      Runs ping.exe
      PID:4704
  - - C:\Windows\system32\find.exe
      FIND "TTL="
      4⤵
      PID:2632
- - C:\Windows\system32\mode.com
    mode con lines=25 cols=100
    3⤵
    PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdf7cf46f8,0x7ffdf7cf4708,0x7ffdf7cf4718
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2276232656179558250,6311786545340064365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:5524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\221c3590-2cad-4296-8e86-a4b233e9b36e.tmp

Filesize
5KB

MD5
b535708588bf8c400c5a255e3dc84042

SHA1
d92be18510f504512de5abacda6621c792bac637

SHA256
6b018a451bbba4f77de1a7b38c0733ebe26a22dc826136d5ed5e7769d76086a8

SHA512
4b9bb3d65e96e744a9b9763a316c2d303f4e362f39b59ef5a6c89f277e4062a3a5e32f1db65f19e424f90636363d82f9e754d418a6eb6c8102ed6ff32fe2fa38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f454a5e6f4e082f8cd272ec17ba9911d

SHA1
264065b6ef063f53f1ccc46b55a81d82a6a33533

SHA256
8194fa6b699387286ac312c5d0f8be19bd0396152f4373ae5ad93c38b4f07287

SHA512
5b68af61895c7ce011412a7f0f4635516ef6143bbc8954ccc9348a98e46472ffa612cdbc22691f537316329109fb63b7036b09d150497c6259460a5132a27ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b7e51f85b5dd636ea3951e880f0b0528

SHA1
bdd979dfaef396583acc625195e2e031ac9a67ad

SHA256
13068ef80b6ea38860525f1b4bf6ad6263bfd439cbabd33053ed9aaadcbc5f99

SHA512
14dd5d960a5a838896378dc793ac39e446f8a9c61c4d01cb00a5f06e02c74f469ec5dad7f894edde5e449fd96b6b845d41b40cf497ab5943fa309550676276a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\4297.tmp\ConnectionT.bat

Filesize
244B

MD5
5094105f12656f58dfe880c14f235c86

SHA1
2fdaf7e924ae794fd7b9a723ff018b852f06a4b1

SHA256
580cbde94fa2b2f6ea55c41d955ec0c2954e19342e39971d4e7801f1d1f52e56

SHA512
ef1fe26fe2dbaa71b889e5d5798ba1d87182b78222ab74317f7bd69822559c169a644f70a38652bdda8d8cff07ae7ea423c76cabcfb8056710b644e9c67af4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\4297.tmp\Pinger_Q.bat

Filesize
605B

MD5
13deb92e63627d1b6a0c130600473113

SHA1
5588040ae00005fe59ac75091705af7596562c64

SHA256
db764778f3cb479c1edc0f428c8314f436824f2fadda914e52749626b5e7ef8f

SHA512
4e905168c6dc81ac7c1ec596360c11fc43c6a2c5b5077375ebdfd3d97e471eaa840689b923449bed74cb878d11d869df4b110f177bcbc8dc317e5bc3e952e71f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4297.tmp\Quarantine.bat

Filesize
7KB

MD5
812fdbe81c5c1bef538abbc22c424241

SHA1
ace7e3c826d2980a917e26be7f3d88dd3da7c52f

SHA256
7c06bc80151fb6d3515090c6a85ddf2006d50412699d37135f9f54a479fbede2

SHA512
68eb61e01ef91831f1a32a837b88728014d3ddc0c26fdac5a3bb6f1bcc36a73095447bc1ea1f6c1fb2b7d72f225ad41b29cb72fd39245afdb508d88f82dacba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\4297.tmp\ps4rcc1.py

Filesize
367B

MD5
0e3e88f33e83dcbcfb19e070c55681ad

SHA1
b841ba4d987fd83621a2a8341b3eb55cd4784451

SHA256
b5c78fba035dd7534a410363e090b474435ff58ceda96cdedb880fdd427f36a9

SHA512
1a479561a9f9b9dbe9d72f26059af4c9ee002ae822931d8b270592a16c9fb5662771f6a3d87d4098738d496c48c853cdabfe8298f9f63a1f1d9e425c6a6a59f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4297.tmp\test.py

Filesize
3KB

MD5
a4d7bcf95d8eff49a5d304288be62ba3

SHA1
e41d8f1d0903d9c4b0a4255e0981a98a20a4375f

SHA256
c16c0ab64d6db6048470fce5e9ff7a1ad176c8e451ffec9f0ac2e1642617d153

SHA512
49f89ff1ba51c806e7fed33feb1bd878cc10975e5200928cf096e95fdd7d4f30c6f58da1327319d9817f2e51046ed2d880840489248326fb2a8da6d8d2f7f7a4

Download Submit