9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88

Resubmissions

12/04/2024, 15:32

240412-sys2eabf5910

21/02/2024, 03:49

240221-edjeksba2x10

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe
Size 1.0MB
Sample240221-edjeksba2x
SHA256 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88
MD5 4334e838a1ad1e35a533d8ff6d55ea3d
SHA1 cb617e4af09ee90e8918fb7488337a935750a318
SHA512 0e107f77986171d13358eb780fbb3c243f1f4afbbfe5f615172e15de2bc1948932b82e592abedb03262444c81ebc86e1e2bfe7fffb3f964289a31c2f5e863dff
SSDEEP 24576:0z28lByb3DFSo0hs6vZ0MZ0ZvJPqljO35FhAJacjuFlewy:0K8vommMtZO35FoQm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3180 created 3540	3180	Memo.pif	57
PID 3180 created 3540	3180	Memo.pif	57

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 12 IoCs

resource	yara_rule
behavioral2/memory/4000-53-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4000-54-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4000-55-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4000-56-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1008-68-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1008-69-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1008-70-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1008-71-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3664-113-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3664-114-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/3664-117-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4000-177-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 12 IoCs

resource	yara_rule
behavioral2/memory/4000-53-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4000-54-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4000-55-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4000-56-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1008-68-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1008-69-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1008-70-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1008-71-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3664-113-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3664-114-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3664-117-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4000-177-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 12 IoCs

resource	yara_rule
behavioral2/memory/4000-53-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4000-54-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4000-55-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4000-56-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1008-68-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1008-69-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1008-70-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1008-71-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3664-113-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3664-114-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3664-117-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4000-177-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing credit card regular expressions 12 IoCs

resource	yara_rule
behavioral2/memory/4000-53-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/4000-54-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/4000-55-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/4000-56-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/1008-68-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/1008-69-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/1008-70-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/1008-71-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/3664-113-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/3664-114-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/3664-117-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/memory/4000-177-0x0000000000400000-0x00000000004B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3180	Memo.pif

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	api.ipify.org
32	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3180 set thread context of 4000	3180	Memo.pif	112
PID 3180 set thread context of 1008	3180	Memo.pif	113
PID 3180 set thread context of 3664	3180	Memo.pif	120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3120	schtasks.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2384	tasklist.exe
3124	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2724	PING.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	tasklist.exe
Token: SeDebugPrivilege	3124	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3804	WMIC.exe
Token: SeSecurityPrivilege	3804	WMIC.exe
Token: SeTakeOwnershipPrivilege	3804	WMIC.exe
Token: SeLoadDriverPrivilege	3804	WMIC.exe
Token: SeSystemProfilePrivilege	3804	WMIC.exe
Token: SeSystemtimePrivilege	3804	WMIC.exe
Token: SeProfSingleProcessPrivilege	3804	WMIC.exe
Token: SeIncBasePriorityPrivilege	3804	WMIC.exe
Token: SeCreatePagefilePrivilege	3804	WMIC.exe
Token: SeBackupPrivilege	3804	WMIC.exe
Token: SeRestorePrivilege	3804	WMIC.exe
Token: SeShutdownPrivilege	3804	WMIC.exe
Token: SeDebugPrivilege	3804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3804	WMIC.exe
Token: SeRemoteShutdownPrivilege	3804	WMIC.exe
Token: SeUndockPrivilege	3804	WMIC.exe
Token: SeManageVolumePrivilege	3804	WMIC.exe
Token: 33	3804	WMIC.exe
Token: 34	3804	WMIC.exe
Token: 35	3804	WMIC.exe
Token: 36	3804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3804	WMIC.exe
Token: SeSecurityPrivilege	3804	WMIC.exe
Token: SeTakeOwnershipPrivilege	3804	WMIC.exe
Token: SeLoadDriverPrivilege	3804	WMIC.exe
Token: SeSystemProfilePrivilege	3804	WMIC.exe
Token: SeSystemtimePrivilege	3804	WMIC.exe
Token: SeProfSingleProcessPrivilege	3804	WMIC.exe
Token: SeIncBasePriorityPrivilege	3804	WMIC.exe
Token: SeCreatePagefilePrivilege	3804	WMIC.exe
Token: SeBackupPrivilege	3804	WMIC.exe
Token: SeRestorePrivilege	3804	WMIC.exe
Token: SeShutdownPrivilege	3804	WMIC.exe
Token: SeDebugPrivilege	3804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3804	WMIC.exe
Token: SeRemoteShutdownPrivilege	3804	WMIC.exe
Token: SeUndockPrivilege	3804	WMIC.exe
Token: SeManageVolumePrivilege	3804	WMIC.exe
Token: 33	3804	WMIC.exe
Token: 34	3804	WMIC.exe
Token: 35	3804	WMIC.exe
Token: 36	3804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3364	WMIC.exe
Token: SeSecurityPrivilege	3364	WMIC.exe
Token: SeTakeOwnershipPrivilege	3364	WMIC.exe
Token: SeLoadDriverPrivilege	3364	WMIC.exe
Token: SeSystemProfilePrivilege	3364	WMIC.exe
Token: SeSystemtimePrivilege	3364	WMIC.exe
Token: SeProfSingleProcessPrivilege	3364	WMIC.exe
Token: SeIncBasePriorityPrivilege	3364	WMIC.exe
Token: SeCreatePagefilePrivilege	3364	WMIC.exe
Token: SeBackupPrivilege	3364	WMIC.exe
Token: SeRestorePrivilege	3364	WMIC.exe
Token: SeShutdownPrivilege	3364	WMIC.exe
Token: SeDebugPrivilege	3364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3364	WMIC.exe
Token: SeRemoteShutdownPrivilege	3364	WMIC.exe
Token: SeUndockPrivilege	3364	WMIC.exe
Token: SeManageVolumePrivilege	3364	WMIC.exe
Token: 33	3364	WMIC.exe
Token: 34	3364	WMIC.exe
Token: 35	3364	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3180	Memo.pif
3180	Memo.pif
3180	Memo.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1864	1824	9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe	88
PID 1824 wrote to memory of 1864	1824	9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe	88
PID 1824 wrote to memory of 1864	1824	9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe	88
PID 1864 wrote to memory of 2384	1864	cmd.exe	90
PID 1864 wrote to memory of 2384	1864	cmd.exe	90
PID 1864 wrote to memory of 2384	1864	cmd.exe	90
PID 1864 wrote to memory of 3064	1864	cmd.exe	91
PID 1864 wrote to memory of 3064	1864	cmd.exe	91
PID 1864 wrote to memory of 3064	1864	cmd.exe	91
PID 1864 wrote to memory of 3124	1864	cmd.exe	93
PID 1864 wrote to memory of 3124	1864	cmd.exe	93
PID 1864 wrote to memory of 3124	1864	cmd.exe	93
PID 1864 wrote to memory of 1060	1864	cmd.exe	94
PID 1864 wrote to memory of 1060	1864	cmd.exe	94
PID 1864 wrote to memory of 1060	1864	cmd.exe	94
PID 1864 wrote to memory of 4060	1864	cmd.exe	95
PID 1864 wrote to memory of 4060	1864	cmd.exe	95
PID 1864 wrote to memory of 4060	1864	cmd.exe	95
PID 1864 wrote to memory of 1836	1864	cmd.exe	96
PID 1864 wrote to memory of 1836	1864	cmd.exe	96
PID 1864 wrote to memory of 1836	1864	cmd.exe	96
PID 1864 wrote to memory of 612	1864	cmd.exe	97
PID 1864 wrote to memory of 612	1864	cmd.exe	97
PID 1864 wrote to memory of 612	1864	cmd.exe	97
PID 1864 wrote to memory of 3180	1864	cmd.exe	98
PID 1864 wrote to memory of 3180	1864	cmd.exe	98
PID 1864 wrote to memory of 3180	1864	cmd.exe	98
PID 1864 wrote to memory of 2724	1864	cmd.exe	99
PID 1864 wrote to memory of 2724	1864	cmd.exe	99
PID 1864 wrote to memory of 2724	1864	cmd.exe	99
PID 3180 wrote to memory of 404	3180	Memo.pif	102
PID 3180 wrote to memory of 404	3180	Memo.pif	102
PID 3180 wrote to memory of 404	3180	Memo.pif	102
PID 3180 wrote to memory of 2324	3180	Memo.pif	100
PID 3180 wrote to memory of 2324	3180	Memo.pif	100
PID 3180 wrote to memory of 2324	3180	Memo.pif	100
PID 2324 wrote to memory of 3120	2324	cmd.exe	104
PID 2324 wrote to memory of 3120	2324	cmd.exe	104
PID 2324 wrote to memory of 3120	2324	cmd.exe	104
PID 3180 wrote to memory of 4352	3180	Memo.pif	109
PID 3180 wrote to memory of 4352	3180	Memo.pif	109
PID 3180 wrote to memory of 4352	3180	Memo.pif	109
PID 4352 wrote to memory of 3804	4352	cmd.exe	111
PID 4352 wrote to memory of 3804	4352	cmd.exe	111
PID 4352 wrote to memory of 3804	4352	cmd.exe	111
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 4000	3180	Memo.pif	112
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 1008	3180	Memo.pif	113
PID 3180 wrote to memory of 1008	3180	Memo.pif	113

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3540
- C:\Users\Admin\AppData\Local\Temp\9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe
  "C:\Users\Admin\AppData\Local\Temp\9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Azerbaijan Azerbaijan.bat & Azerbaijan.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2384
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:3064
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3124
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 22907
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Ap + Friend + County + Laws + Plant 22907\Memo.pif
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Bring 22907\g
      4⤵
      PID:612
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\22907\Memo.pif
      22907\Memo.pif 22907\g
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4352
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad.exe
        5⤵
        
        PID:4000
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value
        6⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -A 'System.IO.Compression.FileSystem'; [System.IO.Compression.ZipFile]::CreateFromDirectory('C:\Users\Admin\AppData\Local\Temp\ADE_LOGS', 'C:\Users\Admin\AppData\Local\Temp\ADE_LOGS_JQGVKGNK.zip');"
        6⤵
        
        PID:456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-Type -A 'System.IO.Compression.FileSystem'; [System.IO.Compression.ZipFile]::CreateFromDirectory('C:\Users\Admin\AppData\Local\Temp\ADE_LOGS', 'C:\Users\Admin\AppData\Local\Temp\ADE_LOGS_JQGVKGNK.zip');"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4944
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad.exe
        5⤵
        
        PID:1008
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad.exe
        5⤵
        
        PID:3664
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:2724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Hotmail" /tr "wscript 'C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js'" /sc minute /mo 3 /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Hotmail" /tr "wscript 'C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js'" /sc minute /mo 3 /F
    3⤵
    - Creates scheduled task(s)
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url" & echo URL="C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url" & exit
  2⤵
  - Drops startup file
  PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Memo.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\22907\Memo.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ap
Size 259KB
SHA256 61e6fb53b7c6b26fdfbee29d63bb36c8dd33ed7fb8ed97ca488d107fbc1ba3c3
MD5 a745de26cccd7229f9b3083e0e657c51
SHA1 ee6792f27d4d5e07f0d41dbd95b0fec772a94abf
SHA512 9f1701d197b8e0fb1cd929404bfd9440c7ba5c724493a9a4831d9a885d1b6b169b67f344e73facefe18a753ebe22d78c61ea551a4820b7fb471d4b6670d9cc00
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12lq+:LO0z8e0lvSr0Wyw20K4mqClq+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Azerbaijan

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Azerbaijan
Size 10KB
SHA256 75978ba45715cad18f1dc9acc0eec4a1e6194cda6cfcb44daaeb851be665f52e
MD5 44c71397920468dddf7bb1dc8933259f
SHA1 fdf205c1c85f3b59dc4cf66523172fa3f37efce8
SHA512 bf8b7e54ae65e4691a7981d6af792797be90bd55554f3f3d9316d0993e421a426046ced50cc91eac0bedaadbc315326201da640190192c1d6ff2d50a3c32369a
SSDEEP 192:xIWA0T5pN0X2qf1WuVuP/oNCjBjrA+zYEnld7E1WHqmVZAWET8hDnRmqOOzE1fLT:1A2LN0mqtWuVEz9jrA+Rld7E14q4SWEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bring

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bring
Size 878KB
SHA256 cd82e9442c7643b70b267a68f2bbe271298e7474b8310cd50e4b6e586b7d9f44
MD5 b833ca1c2478a60371622ef394d6867d
SHA1 4278d7af0744ed090c541563cbc2792988d00cd6
SHA512 973dac96f9ecdf43b2bee02ffbc06583375c3fa6d2abe3541e8bb3697a6bee49f824954abb37b3385ddaf2c3447d8cea83e063349a8d5971ae0908f5430cfb0a
SSDEEP 12288:1sUK4IFBTy3J4Ywo6a+fgca4FBKwB2HrE1srsZV:uVTYJnofgca4cEers3
MD5 SHA1 SHA512 SSDEEP

Submit Download

County

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\County
Size 206KB
SHA256 70c40c9ca3ccfe1176875a073e911e8deb3e015b6ef2fd0051223a335dd76033
MD5 23bfb44f90ecf7e147b21aeb638be0e8
SHA1 0764403645568683a776ef34bf4eb7c7f8775e6e
SHA512 d8e8caccff81bee0f30b2c12c40a976b9d1df94c50208647959bce2ea3dd4a2989ba4bec0918a0ff8a9456f5dad217acfb03b46f3c97eebb7139ff9760e29278
SSDEEP 6144:mGfm608DsvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYmFqZi:mKmNvqJWNAB+X0lHPOGNnlMZi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Friend

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Friend
Size 156KB
SHA256 f70978891348d7b742c8012d05be109c5d93e05207dd0ac4d16484e496973552
MD5 8a0bdcea077716b3eefce44a2de444ab
SHA1 3724020a71d0f9cc13e5f7bd4d079c92fdb01bed
SHA512 5ea039830291f78baabc13e00cae55532cf4aa77aca03955fb080e7da1b79f55334b22198238e85f090c3f76898cacf3a476704acd53672181d349d7a624cca7
SSDEEP 3072:eEAehuqCkrwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz5YaZYvlfAT:eEAehuqN8zwNzlmhPL1b5nZ2tZ6lfAT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laws

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Laws
Size 284KB
SHA256 c522ac485cfbdb75bb3f35bfe62263fb17cb64464e111d2e287b9084a85ff670
MD5 cadb4ef1a35122c6bff9f2e1774ebbe9
SHA1 b711c1429a69a8922da301606b2e19648a0fe537
SHA512 6000f5511240431a9e320c5e2351a8518642786fe1aa0a59a5d523eb7899b88bf6e3ab5629d6cbf34866974b41511fdc55a83923c56da0caa92f20f360641f7e
SSDEEP 3072:Y5A3q5eAg0Fuz08XvBNbIaAtbPf6jKj+wsxjgarB3RZgDWy4ZNogXJ3g:+EAOz04pmdV364EgarxUaBZ2mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Plant

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Plant
Size 19KB
SHA256 7d270a6900ef6385133b30e462bd157aa925543abaaf248cffe263fae0c33f4b
MD5 29d98b6cbc770d518dfbf5fd2f4fa178
SHA1 1d030e6fd228895d071c28f8e5f70676646f3734
SHA512 8e3e890523a31c0ab4ac80400215fdd860dacedd45baf25e02a61b3f52b7fad8424c632ce2996f6f0a6e69f8a29db838febdab7636e7204b50790ae0adf0e0f6
SSDEEP 384:VR0Xvwp52UW1l/hw50gFQTVaeCV1VEVFJ8ZcGwGBk7/UMQ3K6:SE2UWb/hMjFQTVat3VEV3GPkjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApproveOpen.sql

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Desktop\ApproveOpen.sql
Size 487KB
SHA256 791372c44a7a5ea3aa265c1fb0ec1f80e461043073ef15b94d6469c725a41ddc
MD5 00a702ec9aa25908adf09da50a8de394
SHA1 eeb0f5786c560be261599e992c516a70a164ad9f
SHA512 555608c3bd8698c8f1a93435392274720d70274113e153fa26616dc06c5c297227b4a5f1481a40b145146acc972dd51c9e80f6145d639b845db2d5f3d6cb20a8
SSDEEP 12288:B2PcCbZUMiGHQRqGkpEIJsmD3IpluTgKstOenhRwCWd/lf405i:+cCVUMfHUqGk+IJfy2stbRWtx4x
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExitJoin.php

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Desktop\ExitJoin.php
Size 459KB
SHA256 d405f3ff50c12d038ac5d44bdb92cda0ed68523230da3541fbb21fdd7271e509
MD5 d69b377413a6e08e9da1aac7dc035152
SHA1 f377af53731d86f0b9cb9f350b5b8d408147e702
SHA512 b528cdd19ae736bfbb4128e7d52884823b96c32125668eea44a3441a50f99d10a8acce30e86c8e7c83f862725129ba6aca64e28061bdbcb884e0b98047cc4d92
SSDEEP 12288:/FARQatzBxxa0bVuov0RK95IHxE8asvVh1yKT5m:/qRQYBrrvSgWHDasvQKTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

RedoSubmit.html

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Desktop\RedoSubmit.html
Size 933KB
SHA256 c5c87bfb79b647846735299b90dddcc6b329b3f7dba1e2a3e7ee73b907b3b028
MD5 5bffeea2c386f69d9cb59e2beebe01c7
SHA1 ca9c6e5c3981c4e717d29ca7012128c2657d06ca
SHA512 82c9efb4c055abd7735de32886f569955f6f83a78a6b974d1bb4abbb8967ad45d27f5d1f7ced4973de38938b7c9a4909f88ddf8a4469e50942a23afba5c873c9
SSDEEP 24576:z3je7Q08gsUl59K089XDDhrbYHayP+o+ymT4V+h2iahvwo:zKj8CK0qr8HaVo+R2hxwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkipConfirm.odt

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Desktop\SkipConfirm.odt
Size 793KB
SHA256 12b8d361f1d73e9252494a57a01a5a5456b7a331dbddb49db47a34fbca2cd10f
MD5 2d517ee63b43ad4d2025d9b7ec843738
SHA1 c7d009f4d4dce70f0adfe982c62a88fb4a711666
SHA512 006294985844b2da081b97f3ff5bd30597109b0151d46a443358e598912a08518ab6f8b6b50e548a9505cdec2d74e728c2cdf3a7eaddfb8b01c6915680a25c61
SSDEEP 12288:fC5r2WrqutI7uzJyHLm9rUnotcwBIj0EIyk0HhF9W4n1deOGM3C43N9Ogp:fw2aLt/zMUtBIj0EXkKl7GM3C4mgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Are.docx

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

DisconnectEnable.rtf

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\DisconnectEnable.rtf
Size 289KB
SHA256 59fcb0c217687fba3eedfa687723cdc8de565abf9142f79156213035b05ce2c5
MD5 917c9cf605531881b7a12c64c3ff3a57
SHA1 8b2388059b0bd7fadd1a39700a28159e922cea57
SHA512 012e06c82709dfdde9805e8e6f3aa966f74520be0e25493846d1074ee968980e1d54ed56fc8bf7a496d2d47d2b1bbc2c96b163b404ca4a7896dda4a697de511e
SSDEEP 6144:J0ylTB9tj1rhpkPdwFDKD/3rY1q3fXGfLeID2tgBLqao76iqXVmyuJ8DJkihhWTN:mi9lVhpkuxKw8aDZLqaXiqFmnE1WUHEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Files.docx

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\Files.docx
Size 11KB
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b
SSDEEP 192:CtNCnd3S7Ok0vaAhs4nYbcBVi6LeZ6iPBkeawLWdxd7ob0qf:aNSdC78rpnYbcB06akwLWdxdEwqf
MD5 SHA1 SHA512 SSDEEP

Submit Download

MeasureSet.xml

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\MeasureSet.xml
Size 554KB
SHA256 dfd187427f8b095b89be3bc4ddd08be095c5ab0be04263f2fd52b0e50f00ebb5
MD5 7596b53f48fbf841aa46f4f3096a5668
SHA1 de4565d43504d4287fceabaf9cc86b820411e4d1
SHA512 55876c4b710defc1b4244718629ffdd1ed42c4d64cf2dace9c0aae6af9021b555c44ed90ad8942b3b10dc125d88b21bec7694d43fc5b3b65ce5c55683653abb0
SSDEEP 12288:6v1cXKzrILEIASClBEveq3VVfI+XmVRW5onYf1+hxx4PA1:6dc6zUTASClB/4VVSTnYf+cPA1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MergeShow.txt

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\MergeShow.txt
Size 434KB
SHA256 ec3d4b800d390c191ea0d1a4744d5f20d0148a362bc082c100828bf5ebdb5ccd
MD5 a77f8eed71bb3f839f3bb3a22ca4eb9c
SHA1 0df47620e45b474b23e71e09badc1a6afd5425c9
SHA512 e9a95d55c9356a730e882d54e78e292b5f42c8488f9eb35803b9235f9a4dd55a9d431b6899f6f452bcb9caae3733b7464d982589d8bec444b9b8e69fee37d937
SSDEEP 12288:WUMSN3wAag2ZDCQKj6+DD4/u+0YFv9wle1W:WRk9D2lj6h4dXFule4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MoveBackup.odt

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\MoveBackup.odt
Size 626KB
SHA256 7d663813061f81ce90472c24df806a7978503a6e1854876b7cc9e43bdd1bdb0c
MD5 ad92a6b81ad092cc4f7979d75b4bf812
SHA1 f1330e2a9b9be6fc972be4c025da3246562370fe
SHA512 732b6a6f537103e40d2bd345cce1021c369b5a51a738f55c2a839cef351110cd98a0626762dae74fff3f0f45405f642a1c29d30da4f8f56e67eefb8436b737ea
SSDEEP 12288:A2Svelx3iuG82JIdYzUiesG9uAYrdMCn4sC2Di9+2L1qS5TeWaf:wmD3iu9NJsG98a8ASKR1TE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opened.docx

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\Opened.docx
Size 11KB
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
SSDEEP 192:CtNCKZkVA03S7Ok0DaRmzRTJYbcBVm+T5TXX6iPBkeawLWdxd7oKJfW:aNrOA0C78EqdYbcBf6akwLWdxdEAfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OutConfirm.txt

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\OutConfirm.txt
Size 373KB
SHA256 f4b208413aebdb38e246adafa34ff231353234c73653ae86a721c41d82685309
MD5 bc3b71204c8237219d57f0df01e358fb
SHA1 27cb0698b529fc4c7af18bac2fa3543bd3dab4d8
SHA512 f89da9c52a890e7b03d766c46c36c27b5400c8e9387f82d6fe02253eaf3d58a51dd57824f88348a7ab7cfdfebcbff7cc47234d96064f1bf67a376c2884e3520e
SSDEEP 6144:CbQhQnHAvSgMtovAVbrlrhC17lMKlk1I2qM+lZcw7mJlpCgLTjgrvluKjhObpMzQ:8QhSOSBSoVbtE1WKlYwhmzgg/jQv9IKQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recently.docx

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\Recently.docx
Size 11KB
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32
SSDEEP 192:CtNCBPq3S7Ok0epRhm9YbcBVbfaKM16iPBkeawLWdxd7oIVRX:aNOiC78eBm9YbcBwl6akwLWdxdEIVRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegisterPop.csv

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\RegisterPop.csv
Size 663KB
SHA256 b226b919c6d158ee136c5920d24e62cd192e4b65cbd56aa3bc321b000b4c0b8f
MD5 788b43ff85df252c9bffd351f7816906
SHA1 2841dc633e79352ddce4f0e582be061b4acd1131
SHA512 300cc1ee7df03bc3664fa86d5de453b6255a36026282c5ecdbf3d9009fff4072c935406f5ba158ba5fc84eabe8e7ecab792e0939df37e33be96207b01e9e1af7
SSDEEP 12288:CsS2XTax5BQqvBpOkvIbloiCmWUK//hcyd7zDNNkeLTsjXwbl:pXTO5BL5UlLpWUUDd7zDNjPqyl
MD5 SHA1 SHA512 SSDEEP

Submit Download

These.docx

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Documents\These.docx
Size 11KB
SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
MD5 87cbab2a743fb7e0625cc332c9aac537
SHA1 50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA512 6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa
SSDEEP 192:CtNC9N3c3S7Ok0SRYbcBV7LDN7a926iPBkeawLWdxd7o8aZ:aNC3cC78AYbcBZRo26akwLWdxdE8aZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApproveRename.odt

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Downloads\ApproveRename.odt
Size 485KB
SHA256 83c04f7d7c60775069a5d8701a8039841f668ad7a20e20add464ed0f1361ae31
MD5 48a0aa9f7835cbfa49dbfd31db75efd0
SHA1 a37406fee69d738622d96037958b3d4c1f15c885
SHA512 ad90d40c16d7f055913e007e454375e07a3c522168506c13ca757cf519fe7859dfde824a34e357eb3c82bfab10692b8fdf9d3df833dacb7bacb260637cd56468
SSDEEP 12288:QROeyg2R5PYHOWg5EbshjZFi6q0tLTko18lxj8S7js:kBlq8O950oG6q0tZOlx/s
MD5 SHA1 SHA512 SSDEEP

Submit Download

CheckpointAssert.png

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Downloads\CheckpointAssert.png
Size 471KB
SHA256 94f922da52c34b2100a06b27efc7f2750d788e4057b0de7855452fb63268af70
MD5 33ee4f3a743dfb23cb9e71641945927b
SHA1 fdb55d6cc94cf4d677685f7f1fad9301d4ce45a2
SHA512 ca782900c0a6634f850363d1702e3dac912550b9560a9e64be27cac917fa7885cb1c67fb87f1205188e7d8bb7def55bcb18e67f31304a9f1ad2ae00c593c058c
SSDEEP 12288:go9bn3YigUfmZEM9mkHzLzYOOrJ0Sb8i9:gw3K9zLDQJ0+8S
MD5 SHA1 SHA512 SSDEEP

Submit Download

SelectCompare.odt

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Downloads\SelectCompare.odt
Size 714KB
SHA256 4c2fce0445c416f61516ebc8eacd7fb8dad5fe7c3ea979484fa079844fd0550d
MD5 162813981819772eb7a51ab82fc8d5ff
SHA1 dd1a586dee15c998193b7294d0cf3ce1d688705f
SHA512 eb66b0e8dbf05b026a786859fb5f947c58c0abd70844842be4a6569addca4e9e8667356bd04dfb2d21c7b3deaec697c5ab8f47ec7cf0ef21bfa3acc6031ec9ee
SSDEEP 12288:6w7tn8+u7Chab3FhGIx/HULgIAbPf+e8wlXRo5VfzObDMyKkMDP4eRrBCE10I:6w7t8J7C2iIxvKRAbh6fugyKbA60E10I
MD5 SHA1 SHA512 SSDEEP

Submit Download

SwitchFind.vbs

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Downloads\SwitchFind.vbs
Size 606KB
SHA256 4768bb7ac44c0885989435d56c50aad76c210a2dfd298663085a327d90c72b34
MD5 608e51e5ccba5d398204dbee17a1d4ae
SHA1 0b22ff837361e857b8145321d4c82b06d794541d
SHA512 35660dedb1713f218382b895123172d565297275c7847de3790fb3c76696120b71c3272e71094b1696e871a3253c2ccb122e00cbc8795fc21a635ce37b2f17f0
SSDEEP 12288:/G03LaYlwKDY+QmjSaxdP/alrFG67RZRBWgfBNHaF2wHUq3xWi06gm647KYLr4e:/h7HlwKDY+dBbHaDG+/BXfnaFZ+Iegr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TraceAssert.bat

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Downloads\TraceAssert.bat
Size 309KB
SHA256 4e586911419f312710e71079311f5666a805353403ce833de15b0d4e80fe8255
MD5 526e72481f9efdf468458ad85c9ad86c
SHA1 b54548053299de7f3dc91ad5b7476a772172d3e4
SHA512 c8c49942145b94316285646399821997c06fdb61fd1f6522d30ee06db71c92720d7505124cd51d191906fc2da16f9d78c0238317ea0e4f0c8e6f71f42c5caf0b
SSDEEP 6144:ePS+eMe1vqtMjk/q5eTA+UwiWlpNz8q7Cfu6/Au9sNSKUnOlV/AT480/D:ePS+I4UkeeTqrWp/CmCKUnO+4pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallRead.jpg

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Downloads\UninstallRead.jpg
Size 336KB
SHA256 b96e66e90261c224f0c3402ca978fdf25e6a2dd4dbc7d6c9a1820a2485a5f2aa
MD5 b35d9fa33aa342b7c3e05625cd64fa15
SHA1 9ec2fb4c0dc6f12408a5c6f26f6177b5c6bddbeb
SHA512 431d1e8a153f6bb28dd3fb9626d9a90595bebba52dc5bb01449dec789193c2e5d5a80df12512694f18642def7539f2696737368eef4bc13456f253823bc3613b
SSDEEP 6144:UvZz692ykIRPYGDW+OpI9L4WQIRZs2sq0GIRI+aLrViP9NIm9te6oR:+56Ey1RCnpIV4WQIRZsN5I3Lro9N/eh
MD5 SHA1 SHA512 SSDEEP

Submit Download

CopyHide.doc

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Music\CopyHide.doc
Size 305KB
SHA256 40b7c891b0d4ae5df9976ec0c6faa74c96930fbb4e1ce198e5971b1b8a6f617e
MD5 1755bde94c0892c4203812456602ccb5
SHA1 2c61d391cac8ce9a04d8cb9fab3414fde9868bf4
SHA512 89d4f7f49594d8bbd02972df7554fac9228a637320828edb25a45efb15378fc1153a7ce7bb66b9c11c461aea5e1b536f2d227760fa8d3aff5a0e60839c57c183
SSDEEP 6144:1ipYGfnuVwvt7rJjhZJkQ3gTK9iQdCI3qCfRnLGaBac54:1ip9muvtLAQwTzQd5qgc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StopEnable.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Music\StopEnable.jpeg
Size 371KB
SHA256 a780cc4c6acec55d44c1e4fe80f6023b201f27d1118b2e7c935d6f01ebb04b38
MD5 bf30d4661b6c45e42c6f7379c5eff522
SHA1 3150d1a21ace8ccd4c5dbc6b319eef1795483452
SHA512 b67c01b49b754ea47c6efeae08ff23bf21f1d098981eda1c54fb4efbb76f919af320678bffcad6fc2bfd47727bd9e9294539e2167bba775ab85e03bb1f983fe8
SSDEEP 6144:eDMBnKF5kqzCXyoTUA7BrNVdSOAQtR8t9LcY2odtj0nR8tA9WAKIOT9:eDMBKHhzcyowWBJjAQtR8t9LndOR2AK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismountMeasure.png

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Pictures\DismountMeasure.png
Size 291KB
SHA256 fed1b8f9333b70a50df309618762435784da1b34188bfe7229de15306881497d
MD5 8b26b2861f13c2d9ef813dad9dd6ecca
SHA1 a421c21b9d244faa71f405e2a5441b9fb0e28308
SHA512 96912fcdb6365fad8967ebdcfc9a5eb7837ed73349a1d75dca68306cea4f8a18258a5f0bdcb2adf5432b9036af8e27e5178a75f9c4deee222e789e6e03c6a6f8
SSDEEP 6144:fcLPa0CdfUlzR+2oUHZ6qO3N0ZLtltSfjgMQZ3n+D7PxSkrz5JQWS7:UVCdfUvHZd3ZLPArgMQZ3n3krznS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

My Wallpaper.jpg

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Pictures\My Wallpaper.jpg
Size 24KB
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff
SSDEEP 768:9pdEaPeFprSA+q6RLpCCg8MeoSYpaLyKb8oPU2e5I:aaPkrSA+qS3g1vtah/Lv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ShowMove.png

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Pictures\ShowMove.png
Size 245KB
SHA256 5d50088f8ff330adbc88fa3c59ab590da03336318e804a8147a2459886940d55
MD5 3de20f367f35a2153507a57d206773c4
SHA1 b6546e5a8000fc71bed4593e8a00b5e28153b619
SHA512 ced656dc39c9fa16f06a18e5f6fd6fa53c2da788c49daab32f3a14f3a66693a0c7c553066bc5b6f9b2b54249055f77b52195c89f48085553024259be4490e01a
SSDEEP 6144:sl2gbUdDNwlR/CXwbGNcsGhgE6q56URPrYUqbPriLg3r96g1A:sCdMX6N1oh6q56+tqrtHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaitCompare.png

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Files\Pictures\WaitCompare.png
Size 191KB
SHA256 8647d5ca579607c4a53d5ef501ea2281a44e57957eacd66d107530f66f2991b1
MD5 d353cdf06f086f5f9d923a625ff8d9fc
SHA1 ce1fb2be5374c07068f392ffbdfc7f1861934c85
SHA512 302bdfb1bff536c5810aaa8c1ca496053e4d0711749dd7ea6f9767ee329618c6caaf07a7aca190ac2cc69398a99eba27ca4c1e58dedbc1f614966bab35c3eb34
SSDEEP 3072:wFjMzmC8nxM5p/5Z75TB1twOUrVcUxIN+ZMYzIiHvwU2JWIxLmSrWR1g04rpb:wZ/xMH5Ptwq2IJYzpz1NSmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\Information.txt
Size 495B
SHA256 9f549a61838bd1420c955869a1e56099e099b844f1c75c40e66ea7b29b5f74ec
MD5 0d44e06e07c4e7960761b7b0f590e5b6
SHA1 f27a60e833408042d9a95565a488551a56d24345
SHA512 465ec90de57b993f8095b5913cec8ec0795d55fe31a6b0419f9df2e17d4a296cbd522709f039cf471ac8ee9b5984b3a38be00c052bd85cb8d463185efdf43cff
MD5 SHA1 SHA512

Submit Download

No Keystrokes Found

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS\No Keystrokes Found
Size 3B
SHA256 e2f79e5b60330bba4c289962231b6ba2957d0b14e7deb3110417003c79dea635
MD5 382b0f5185773fa0f67a8ed8056c7759
SHA1 08d2e98e6754af941484848930ccbaddfefe13d6
SHA512 3d6fac2f8bc5bec0e79713cfd41962d5463349ff21010a28675b7535cd7e39cd19866428d772a0c57b4c29f623882fb6ff6613b6b16502b74aa204ac1acc084a
MD5 SHA1 SHA512

Submit Download

ADE_LOGS_JQGVKGNK.zip

Path C:\Users\Admin\AppData\Local\Temp\ADE_LOGS_JQGVKGNK.zip
Size 9.8MB
SHA256 754f72fcc886206dcfb9dc22528a968276213a26fa6627c87621632dc8ca5518
MD5 ed57a42e85517414cfbd5d4f4b8a2328
SHA1 a4c17dbc24004509baeb5aef090ed55611833c9f
SHA512 a616859457dbe2b8890cacabbd5652face8cddb64d6494d2dead7823ce2f3bf56c139d9f86d6e5599f7429eea47bfa7ff1d1828cc1195a6ee226506682f8e6b0
SSDEEP 196608:5MmQjsGznf2Sfm0HwDaD2XrtevbI4Px2mcewaG26tKxeglBN1peV/e2n0VF3Kd34:FQQGzxmrDaCqbIk1G/QxeWpeV/B6FavG
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_of5wozww.mz1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_of5wozww.mz1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1008-68-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/1008-69-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/1008-70-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/1008-71-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/3180-47-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-39-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-27-0x0000000077B51000-0x0000000077C71000-memory.dmp

Download

memory/3180-34-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/3180-35-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-36-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-37-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-38-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-40-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-51-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-41-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-50-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-44-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-45-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3180-46-0x0000000004720000-0x000000000477D000-memory.dmp

Download

memory/3664-117-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/3664-114-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/3664-113-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4000-56-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4000-177-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4000-55-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4000-54-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4000-53-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/4944-123-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/4944-124-0x0000000006100000-0x0000000006166000-memory.dmp

Download

memory/4944-119-0x0000000005AD0000-0x00000000060F8000-memory.dmp

Download

memory/4944-120-0x0000000003430000-0x0000000003440000-memory.dmp

Download

memory/4944-118-0x0000000003430000-0x0000000003440000-memory.dmp

Download

memory/4944-122-0x00000000057A0000-0x00000000057C2000-memory.dmp

Download

memory/4944-135-0x00000000066C0000-0x00000000066DE000-memory.dmp

Download

memory/4944-116-0x0000000073000000-0x00000000737B0000-memory.dmp

Download

memory/4944-134-0x00000000062E0000-0x0000000006634000-memory.dmp

Download

memory/4944-140-0x00000000079C0000-0x00000000079D2000-memory.dmp

Download

memory/4944-174-0x0000000073000000-0x00000000737B0000-memory.dmp

Download

memory/4944-139-0x0000000006C90000-0x0000000006C9A000-memory.dmp

Download

memory/4944-138-0x0000000006BF0000-0x0000000006C0A000-memory.dmp

Download

memory/4944-137-0x0000000007F00000-0x000000000857A000-memory.dmp

Download

memory/4944-136-0x00000000066F0000-0x000000000673C000-memory.dmp

Download

memory/4944-115-0x0000000003150000-0x0000000003186000-memory.dmp

Download