576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2

Resubmissions

02/03/2024, 23:44

240302-3rekjsah777

02/03/2024, 23:44

02/03/2024, 23:41

02/03/2024, 23:40

02/03/2024, 23:33

Analysis

max time kernel
218s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe
Size 807KB
Sample240302-3rekjsah77
SHA256 576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2
MD5 878778e2e88e75490dbb137bb293e742
SHA1 a5b965521405ab351d07c91299d8a99d113b9491
SHA512 998728261ac8e3f81a1cbbfe4fb25d655f867727b7395118be5fd1ff72848c2d5a668cc6177d3473ec576e0e9eddd67c0fe022b5bc85d6c1fefaeee4f6e38e9a
SSDEEP 24576:+lF7wSx6dH/hR6rLEMRxonoLq3FimRrEH7mB:8uSQvR6xrooLqVimXB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000001e59e-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1948	576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001e59e-1.dat	upx
behavioral1/memory/1948-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1948-8-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
71	camo.githubusercontent.com

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-399997616-3400990511-967324271-1000\{7F817636-3D57-4223-B351-EA02FBDFE130}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
5064	msedge.exe
5064	msedge.exe
2196	identity_helper.exe
2196	identity_helper.exe
220	msedge.exe
220	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4936	5064	msedge.exe	94
PID 5064 wrote to memory of 4936	5064	msedge.exe	94
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3508	5064	msedge.exe	95
PID 5064 wrote to memory of 3476	5064	msedge.exe	96
PID 5064 wrote to memory of 3476	5064	msedge.exe	96
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97
PID 5064 wrote to memory of 3964	5064	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe
"C:\Users\Admin\AppData\Local\Temp\576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9df8b46f8,0x7ff9df8b4708,0x7ff9df8b4718
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\Temp1_Deskbottom.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Deskbottom.zip\[email protected]"
1⤵
PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 945c7bce57d207a853cd4bf3433426464215c3a650648450ccabc72f5881df7d
MD5 9488bdc1f7d2b4f9928ed535881f5893
SHA1 dc627952155b3569280e85bfb1ebd84ac4006711
SHA512 d06962ed50557b3c212a8374946a0eccad6f4dabab98fc18cb85cb5a67811ef1f4e9f25a57d71483a6927091a5ab8f037b363995cc7aecb5bc7ac45b2ef5bff3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 41dea7ceab58bf0b7c2c040d4e6ed472ba484e399f67c762e0ea77c0692468b6
MD5 dd40d8afbb1de95de048fb408d21e66d
SHA1 781e242a7bfa1261a73e8c2dd324f33874fb1618
SHA512 c63a6fecfca08e7a8ba99068b4730e77a587ebd481c735c0e47658cf0359069d4e0542797a5023091896db192d5fbe1fb6caa5b405ec23d6fbe07afdd80ef6f9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 861B
SHA256 a86ea4e0c102ed4f93a8dc65cd1b08c56616af4cd8acd0534023bcae459fcb40
MD5 69fab2cf2575541e4f9d07644eda8814
SHA1 fa8c08a71ad7326ca6fb02238cc0c21f3e8078fd
SHA512 2eb44ad0b658ad877b7ceb09b29ce6265f0333361bd90ad55127b5563016aee9b94c46ae3695556402b21be84f877e4a4dd99dcdbcbd4ad5d1e1e9c1db34b7c2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 861B
SHA256 3e8d8a01539125c6b33594b20ab02ae2c88bc860b96abb165feca50b9121eefa
MD5 22bd056361cb617080f450804c85fa36
SHA1 f13514fc59d9e3909b76ad33e5d73f489d2f88ef
SHA512 b06f578515fe0408f21fbbe2d730e0f504c47f767810dd1906519ef22a91d6e7b6a8c19ccadeaa40fb5cce9bf8f67f490782a025474d66fbfaf50b473ff93b8d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1dc7afa16da11dd1c089d725851e51e12cacf060b7a1515ecac721810875f58d
MD5 a9ec543833cc5d71c02e0917e9b8886c
SHA1 23f5ce10e54232d6ad9c7e4bbbe3310fd4bf10ef
SHA512 704ec29fbdf6299e7e174b0f9ab1b20286439b1a6397041bc127d8fa4439f891f45ceed4232bbc164cba28697fc0d56226e456ad8361ca63c6af12dd67d720a4
SSDEEP 96:n1qkQxm/K1mqFO1OTUwpvWMoiVmdeH0Qp0tjuUWQyV+VD7AiEwb:nckhn3OUGWMX0t6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d7cd968c0d6f79d9ff713e01931273997bdae36db5951f37e77c73f688c040b3
MD5 e509b8c1fea036cb5cf58470db37f182
SHA1 e47e7d39d05caf3304bea8a565322e7f23e3780f
SHA512 a77b13346142a024fe3c23a58e6f4e4be772aceb705114fc30b00251db9721067fcdacf3a59a5a065ed91bb46a17a565e5fd08f5fdc4822d00986e574953f8a2
SSDEEP 96:n1qkQxm/KQYmqFO1OTUwpvWMoiVmdeH0Qp0tjuUWQyV+VD7ziEwb:nckhT3OUGWMX0t6rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 aeecffc69524322dadbf5f4755e01ddc146699e4826d6ffe70a03d06a1b3ec5f
MD5 36db9f57aff8bdd40915d2561c42e740
SHA1 68fa6aaa226c0971a29c6d0b19f76a1f2152a7e0
SHA512 fe757980b83e540e16dbb095b499be04707799cd3d04cc801a72e7665721afa6bb9c44d7a748801e98a8d0f7627659989038bec4bab174a553d0a7692d40ef7c
SSDEEP 96:n1qk8sQMxm/K/mqFO1OPRwpvcTMTWMoiVmdeTyzh0csTuJcs91j0Qp0tjuUWQyVg:nckCr32Rr4TWMjyzPwuSMhSt6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 053f6282cf11de4068cb2f7f2526544224c6f6b215d6ae8028b34bfa41e73163
MD5 466e5511dc62043f5d11a3feec6b2baf
SHA1 ad98cb3ac403b5c8ffbbff079675be5b42482f54
SHA512 dca7dcecd317660f859624ac60d253e59bf5d910395a43bdc27c038ba73b4a84609d20370808d994369097ea4025092cd242e458f7ef179f390a51623fc06bb3
SSDEEP 96:n1qk8sQXxm/K/mqFO1OPXwpvWMoiDRjR5mdelYyMkucsTuJcs91jG+aF0tjbyWQX:nck3r32XGWMDRzYyvwuSMhGct/lg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 18afef14ece11e8477e314b5ff4bdcb837df785326ad23613000b9f72c71dd20
MD5 6afcd23deb7002966c7ed8c62fa1e08b
SHA1 3f8c1db9c1ccd0305e040350aa7a44d6541ae086
SHA512 97e2b6cace557a3c821fa39edbb83da8f72500fdce387df583e93b82c1ad234bff7757e5da90c34ffbf5ca5a032f49b0646a63389cb55171ec9e189c15d897a2
SSDEEP 96:n1qk6xm/K/mqFO1OPRwpvcTMTWMoiVmdekcsTuJcs91j0qcsop0tjuUWQyV+VD7l:nckHr32Rr4TWMlwuSMhg2t6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a08c3000fb9ab2e58f8e55f38107fffb8dcc58e16f5dcff53e7d499c5d4b636e
MD5 0202db1dbb624427b4b68f3cf83417fa
SHA1 3b2246792cafe4d1aaffd5aaa4e0f9fcf504e98d
SHA512 f4df2c6968bbe66247ffa2d24dd9947fa76a38e096e7bb65e5f3f395379c33eaeb3d7b909b475741a03820f98737a589a54b743e2e5bbc72525ced082959eda5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 218abd62ea55c6a10f6e831d2edfe2db527480fbbdc3dd7aeda6c9e630944b14
MD5 011e84e4ca96aada57477ad702505745
SHA1 bb6f980b1fdaf40c11e249acf3114387110086c2
SHA512 50fe55329abb5932fa9fa31811a2d33a7109aa6b85708db6bd68bd500e537ef39434476d4c9a9c2780aca1c057175f92a8b0ee9e62cdf2b70d9ab25d852fa49d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5867dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5867dd.TMP
Size 1KB
SHA256 e062e895b335c9ba85a3582991dda6e583a323446202347a23b70a743ef8f0ac
MD5 187191e7e33782318e2a9f7fd1635c6c
SHA1 14e3bf726845b9ac12e75d8f9d573a2bd93fdf2c
SHA512 76e26c3bbffbe8ccc9942c3c7cea1ed7e25759b5eb87eabdf15697377bbb8d160c455b083098d4d7724fb915326d32d6435cfee01d97e8c6de4c17587b2ca54b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ac1758be4fe1b258cdc321c26119ac8424f7248812e18961d20c14123c72fdf4
MD5 2893db6461513dd1698858c859599768
SHA1 d6ed11aadfb75dc031b106662e851556919e2a63
SHA512 e3d9503d65fafbd4940f8c00961958d0feed4ea4be64015ac042e1df3d6f0e3f834f3728af090d3885cb9d70edb961c8d3da36e04c2907c5c08d8a47124c6fd0
SSDEEP 384:t9iIxuERzA83h09RZxYwI8OvbVcO9E1MeuBOx6:WIxuERzA83h09RZxqvbVcOTOx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2ed0728642cc606ec937ab0c845e3264f078601c0a6fea34c6e8bd2f1d3064b5
MD5 a784e8eb3a8e4566f234590c341e5ca6
SHA1 b1902b88bba355894c071c36b00987d3304737f7
SHA512 6082b3fe774ee6d1e38005b551d7a6f756406b246a4c8516559cb2c358c51a8dff2fd2b320db1fb3e1bf49ae98f3e09b3cbc0c1483ca14ac3aaf60b76a2a0930
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwIOY+e2RUQxbXF9xUX1MPD:A9iIxuERzA83h09RZxYwIOfF9E1MeuBf
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompressSplit.html

Path C:\Users\Admin\Desktop\CompressSplit.html
Size 360KB
SHA256 b3dfd6f848749413ca2cda6e930fe29363931c36a9a74d2f39d14f575190be54
MD5 5cc5b7386a2d609445e366fe76d4b8eb
SHA1 f989fbfc435e28cf7c33668ceb974e016e31a199
SHA512 f1fe229054fdad0a91105edb96c1ca81df34751f2221d21746f2baf4d1b6ba155eb9b8d20f226357983b4ee94a8312bf6ec97b6aa76b5b6c09aa3ab7ff25af3b
SSDEEP 6144:fcLPa0CdfUlzR+2oUHZ6qO3N0ZLtltSfjgMQZ3n+D7PxSkrz5JQWSk2dgkenBQU/:UVCdfUvHZd3ZLPArgMQZ3n3krznSk2Gb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ConvertProtect.mhtml

Path C:\Users\Admin\Desktop\ConvertProtect.mhtml
Size 386KB
SHA256 baa74f67bc68c6de3c28deb2b02885efcc20de90f99baf39cb1dba20b79d392b
MD5 a2d5e94b6bbe7251fa12d1051c67a2ca
SHA1 7de01ae1b51c113d3f33a1c33ab30ca3447d456c
SHA512 f159dbbe1a0da50d4b68c356ac9434ba699373d413cd7eeb3685831b8075f45460cf20df6b5d01f328ef66f6931703f453946c85bd1a4265debc48b646064015
SSDEEP 12288:XwBf6O9cUS7JAWpI8OVgdZK7MUfPYPJLWRok:XwV6OGT7SsmgdZKgUfgBy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DisableConnect.xht

Path C:\Users\Admin\Desktop\DisableConnect.xht
Size 920KB
SHA256 8b737af57b07bee3550efac39e1ef3260f16f2fee81e5c20d22b5345e04c4565
MD5 949732ccaf4e4fd2529cd70d36aeabff
SHA1 a61a3d00f8e93f9f466e4885a9a98a41f79bbb70
SHA512 97db55c187eaadefc5c78037e8389bf071ba75594ad3bdcfdf2210c93a06805a052b358b47707ea64fdce8b6a61823931fbb9eb4d83322875fbcc747e3f2e371
SSDEEP 24576:z4uVGwak5ByOJCVMkSiWANaiG4B89CKOvND5G1orp+j:ZVGXOByUCukSXT4ujOvN5Gygj
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnterSkip.docx

Path C:\Users\Admin\Desktop\EnterSkip.docx
Size 573KB
SHA256 1c257d1b90725561ff07e6ad4276967dc6ca3f144be6041280a9ec0f8109e6fa
MD5 b36c42dcbda0c308e9a91dd25d9dbec8
SHA1 f248aa9986e9bd5403a3f9d8a1d7017b7d186caf
SHA512 eb39bdda42ea7c809ccd1b93cf55a562b09b1023b9c7dd0322847ec9866898c68c2c8b9435cf6ac9194de6710a56ca709edcc17225ac0773f677c2c995117941
SSDEEP 12288:hhDWGPJcJqjjaSDGKWBhPlJ833EDFUf2t0aJ:++JAqPaSmhPS3ExUf2t0O
MD5 SHA1 SHA512 SSDEEP

Submit Download

FindExport.dot

Path C:\Users\Admin\Desktop\FindExport.dot
Size 493KB
SHA256 00d2af69da72c064dddb411651dc13043436bfd7bb895b54e5eb9644bdbabc21
MD5 dd2a721d3430ab87ca8c4e2e71143430
SHA1 373fdab02eaf57e2bd3c90bcf2f532019e8c29d5
SHA512 8c5a1a34fc4252597ddac80fd67bba0901aaac754fb9c486dbffb5545d6564aaa43cb7d4ac3b8029207900d30afc1e82b80554bbb146bc43cf1f707c8a779174
SSDEEP 12288:GfEKSiftD5p5XYmG+j7H2gpvrxIxXEbt2cRo:zBAtVpBVIgp1IdcK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 53d9d3002ca2ee8acb92a3c3233697c8bf3f7d04365c62e0fdd963a48f7ce6b7
MD5 cff7e263d174541a347ec392aab798e7
SHA1 d5d184997f087684605e1ec77b82951656bf1599
SHA512 cd7fd1935694192fa7af02fcf655eb09128e1cfda92440344e6d46322398f768c798b4cf9bbd9cffd833787ba9ef3fa429b9de7e57d46b4f5ae226fadafa808a
MD5 SHA1 SHA512

Submit Download

OptimizePop.nfo

Path C:\Users\Admin\Desktop\OptimizePop.nfo
Size 840KB
SHA256 3a65df4d9f89ca4a1e86a1704f46ccbab825f70202389952a7942f02baa0c5ff
MD5 3dfb8605789fa6684189a8bcc91991bb
SHA1 213db9e1e08a0c42bf6db04d2ee00355de13bed2
SHA512 ff97afb635b5db1e87864216aa197963fd9d2b5bb0da387e21f14802b01c781fd38176e702c2f7448f52b028837b497354a429fa498c41619bcb995a0ea0b795
SSDEEP 24576:5l9sNA1IB6VRCsaxe2494uTj+f0hTSXW4mJ9fn:5l6A1IB61hTj/hTJP9f
MD5 SHA1 SHA512 SSDEEP

Submit Download

OutWrite.ini

Path C:\Users\Admin\Desktop\OutWrite.ini
Size 867KB
SHA256 921583ca272c83c6a97a626126a062ec69e349aadb5fb09dc4674fe4556f4c25
MD5 ee66c3676077b9609b6eb0f6a2927b75
SHA1 7b32b642c96c6540395957b9751a5e3bc4b57714
SHA512 d40cd7821e6372889a8a0f4c00b1b78aa97498b3a57f57db48a75f0239c45f54bdb9de5416f7e5a8c8a4ca5b85454750379041ef30bb410218a537206036cd3b
SSDEEP 24576:eMTFH3JcWwoDXLT+CVdcPaDh9TOltKA9v0JvS:jFWWZXLT+CV4GhxOb98JvS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProtectUnblock.aifc

Path C:\Users\Admin\Desktop\ProtectUnblock.aifc
Size 947KB
SHA256 7816ab82901af6d8c1dcf31f70872957f52345e36513b008d8fd62ca3fb907fa
MD5 f7daa8e8ada7ee410e0d785c16c79270
SHA1 cb062f47d5db647149f02d9304947cf04681958d
SHA512 d19a8bf3c74d0726cc0c3d67c17691e5437e6f69e8a4dc734a666bb6f998f4ee02feb9f5dc7b5dd61e443dade9da01969913198338044a80f21232a29571da83
SSDEEP 24576:2i2P1vuWjlsiWgJ9eHYB6DfTqQ2WwF/dwUrRJYTM6:2i2rT92YB6bTSWI1w5M6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReceiveRevoke.asx

Path C:\Users\Admin\Desktop\ReceiveRevoke.asx
Size 680KB
SHA256 01fbd02b38e8cc059c96944f99dd79d36ad912113bbdc3f07b0a9d284906f551
MD5 361339065ccdd81661c1419e58d954ff
SHA1 003f2f6d741332bb4e050a6c6b8dad623fdc28bd
SHA512 d22346a0ca83474d21de4e4566dcee7de4fc84b54426f3e056cde7c5bbaaf4e8532cd8c698e1a368cb9afeb6bdbd0fad290789ddba420c07b7210fd08a73feb6
SSDEEP 12288:ubcz966ka5dnQHDAfcVwrR40sOXRkgT6E5dPibuLDb6+H3vPVIqQOgc7QsGRbP2:4cx3NlMucVwruxnguE3LLDp3mqQf4QBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

RedoWrite.dwg

Path C:\Users\Admin\Desktop\RedoWrite.dwg
Size 760KB
SHA256 a16e1b833c8baf5a9014d99241236827cbc6f8557796f6c84ee7e947b0eb0d6f
MD5 d6db6eb5ee65391c4b12cd3406fd22d4
SHA1 cf23ec704589acace557c90f36afb7a9bff14ad5
SHA512 c86a3af8a87eacd9f947e1479c828046dcf48fa4fe818e6115b7d2b302ca62a8711670f137f4e133cea430ffbc6c4711fbe7d92720a279c3cdc648694cd54d8a
SSDEEP 12288:DAfwyeBbGAgmzWKAX/uGHE06wx7A3qjBXzlDNXIu83mrudIDgo3U6txj0CHUtE:DAKByj4JAvuGHH6MA3qjRy36BgoTtR3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegisterClose.wmf

Path C:\Users\Admin\Desktop\RegisterClose.wmf
Size 520KB
SHA256 2b66408bc405f864354786a4f496dbfe7d4c072ecfe89a5c12b91625b2252319
MD5 589c97c47aaccde22952ea30e39649ff
SHA1 3b8140916cb7f5a72f7522424db4739edbcc0a3c
SHA512 0615110c9ab8c825323a805adc4f6cd654aaa20285a86d10abd6cd125f72078d333bf0a95538b06924800a223aadec7040b4d276a20a2d707010dc1c811b6f1a
SSDEEP 12288:Ts3Szz/5kKFOak2GXZr02vuX5/jPqUxKOOCSLe6ukWhK:Ts0Nka4pDvuX9HPSLeDc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ResizeConvert.cab

Path C:\Users\Admin\Desktop\ResizeConvert.cab
Size 600KB
SHA256 08c36a55a7867efa99b018ad233e34a45bc60568eeab80fe4a48f64121e3fc7c
MD5 74847c85a94e74d76dae2e6eea7a22fd
SHA1 9312b10f7b9f772d85b45141b7bcffb310b54cc8
SHA512 04e7cfcb0b64d2419b0e805aeeeb6810e29ef914a9c9c88d035a79b87c4c614a9a122ab8ed08d86db3eed1286cb2f9b610380f28faab55f66a865faeda84b366
SSDEEP 12288:8hxzcyKzpcIkYIIDMeZ20zw2ocFlCf5ijNqk4HxBr5kFt+PLSim:CeSIxNQHwCBqNorSdim
MD5 SHA1 SHA512 SSDEEP

Submit Download

ResumeEdit.mov

Path C:\Users\Admin\Desktop\ResumeEdit.mov
Size 627KB
SHA256 ec732f996a0b7e7b28f7e515c43bb17cdf80c5f06d200ef655fbe6b82dd8a8e0
MD5 331667c02afef0f54a168838115b9a31
SHA1 fbed9de2ede93edec339c28cfb47f023505f848f
SHA512 944a854f81d782bc358cf680b9c0559678a8580af62bec14d7b4a163c2339e5b75c07dde0fa117fd69a8958cf9b71cae8d40d74933bd3b97974659963c34a05d
SSDEEP 12288:+b1QjnzLQSThyk84ouvFiRLPlVxoRfpeGKRXPsUZ2si3kakUUB4j8AfziI0C:+OjnzLQSTpouvFiFnGtcUUZharC4IAff
MD5 SHA1 SHA512 SSDEEP

Submit Download

SaveResume.cfg

Path C:\Users\Admin\Desktop\SaveResume.cfg
Size 894KB
SHA256 f8ee191f964d1e38e922f52cd79c19c15c54e471be3455c17359427edb000207
MD5 836aef5bfc849b5b3d578b31787b8ca2
SHA1 534cde681838758256276574b38b72ea44809021
SHA512 23ed9277647770e6c894308fb51c1374ecb5425c906ead601ad992309d05564dd8feefb807e81dccf7f8dde086ac60fd114437c2fac9679b4ed2b177f39a9747
SSDEEP 24576:Ecz3VF7Y6t+Psv2wv6wMeRYHksJDiuVh/uqXP:Ecz3Vywv3ylNb
MD5 SHA1 SHA512 SSDEEP

Submit Download

SendWrite.scf

Path C:\Users\Admin\Desktop\SendWrite.scf
Size 547KB
SHA256 042f11f5d29e88d547db2503c3ddf80dd12fd4f57a65e2786f034c842f79d016
MD5 cc6a515e23b3193032f55572899c25f4
SHA1 9c1061ed7a84e3d69bd10343a43a9e03810c735d
SHA512 92cd3d715d74e385e083888fbb90db640f611b0448f3bf6723a4a469523b911771f413fa124c0d7b67d6f1fdfdd2353d7c1cc11f16bd954130258536c0ac1a59
SSDEEP 12288:cjAUIbUx6SS9GAmP/6BWwttOlnEhyBUIX1PgFSrKZDKeLGXW:cjAqVzAE/wWQtOlmyBj+dLGXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ShowResize.ttc

Path C:\Users\Admin\Desktop\ShowResize.ttc
Size 1.4MB
SHA256 bb31b75f1cda7fb51f833727cf671a761f1ba2081df33e347dbdd2fdf27065ef
MD5 0773ad06af3356b97efb67b5ec78e73d
SHA1 6e87ed7ca77e3043f48b675050d59b1d74eddcbc
SHA512 6ff6b9d0bca42f808bdf8acd77a7f9b9fd32c6f57f37fc5e395582ae3ea1e4529a1dd52e91b3da3b7924f74dd61c29b05ef1111d9f97f04d20d5c26cf6039b18
SSDEEP 24576:uyMSsXSf9NqnY+O3za3wYVe7Oq8B323GAnTYNibiieJvcGbZct8nlJ+TMUe:qL4N4YLkvoj8BxqTYNJi0/unMR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkipExit.vsx

Path C:\Users\Admin\Desktop\SkipExit.vsx
Size 733KB
SHA256 51ed3057bee44a456e3d726302be9a16743a29258831a7937fa751a83ce3bfbc
MD5 49fb29af9733957be020bb7d35693a8f
SHA1 ef10d14dcfcc8e44601d06692880182ac1b42cda
SHA512 114fa2d50745877325f584e5450e6e5d33d07766004c044d1fef186010df97365c54660116ea2cdb8ac9c1b8c06f3432bcf613ad9d094be34a0d93e82cdec85e
SSDEEP 12288:uj3LJoXVklzSheswUyn3nFAktcg0acGiCULE7Fy7lrOiHMQ3+fPucQAw9FXc6E:S3LJoXVCAWz3nqktcbacGuhsQusAwvXK
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartSkip.vssx

Path C:\Users\Admin\Desktop\StartSkip.vssx
Size 707KB
SHA256 e2e3c0b5dccfec28683e307eef94c21743db4cb954ec6ae364ca972fcf48bd31
MD5 d07ee06cbbe728727576c3537bba2888
SHA1 b5a7ff44770c8c1090b540ef2cce8d1a1e988148
SHA512 a8ae36502af53fc95725271415fbe4ff8b731e6e4d42bad14a628450104293ab6c16e275b317015953c29deadfcd4a8024ec21174ee45de9963e3e74fb917506
SSDEEP 12288:N7RxOMiwwXS1NMF5ORBFl1m7FBUezf2Z8f/y97QlYpNEiSbl0VxxLnhIyHt1Nor:N7OMiwwC1NMF4Rlk77VOZDQGSqlLhzNa
MD5 SHA1 SHA512 SSDEEP

Submit Download

StepCheckpoint.kix

Path C:\Users\Admin\Desktop\StepCheckpoint.kix
Size 467KB
SHA256 25f7ddffe6f4c91ec6c7c7062c47a2775916dc7cd9f0ea7a6d818eae50b65949
MD5 159aa289d5e16681c52e21eb6adf8f73
SHA1 826c17357498d2c595628ee87bcfeaafcd56fab4
SHA512 a8c13a6743a41eb2e664ce4f5145a748740f80a1fca9133770cb07134a40bf37471b7459cf577b3668d3c4990e82bba81ad95a99f3ab9e75caa36c7fd6b37250
SSDEEP 12288:BAh2IHfPyg3dUAgfvm11r5chv48WBh6DTQ8V3JdYQGG:U7Hn3rgwrehgbYQ8V5iQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

TestDisconnect.rtf

Path C:\Users\Admin\Desktop\TestDisconnect.rtf
Size 440KB
SHA256 a7cc4199c999e06fa375aa3f6f94d4f466094de3ed376d178c1346ce259e55f1
MD5 f86c868dc6285621200609d15e23d56d
SHA1 076b9082b3569ef31b51d57e088a34c395a27b34
SHA512 deee6cb315c3f81e10ad2544eac8b044d72c22d0c5522ccfc6ed6c16d35c7af433d1abcffeedf358640b9e1d8b76d5d1728a04d60bb14e59a4b797d4e8adf7aa
SSDEEP 12288:WRNR8wvqH0+Eh201X+XKEG4QSPyU7fGgFkkWd:WRr8wSH0h201uXA4QtUjGgmkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

TestUnregister.mpv2

Path C:\Users\Admin\Desktop\TestUnregister.mpv2
Size 974KB
SHA256 9e9f3e47a0fed55ed1d9471ee940ec9db189105e14747dae8daceab805dc5d0e
MD5 917a015a9da97d025ad85520c2694665
SHA1 ce8e67a85c296984bf1857307ff8b5334e2a067f
SHA512 59cc8128bafa14c28a3e2559fa7bc1e909d2e021df3c1b701cb6abe86be3238d3c06c21cd97b309e72f856e4c7d35567cb2e616eeef02af02f2cca62253f162e
SSDEEP 24576:C4/YXyV9rjJMBuMNj+61uTsL86d58b7I65qk+vBihxKSo:CKjm/B+kosL8G5K9kZihTo
MD5 SHA1 SHA512 SSDEEP

Submit Download

TraceConvertTo.vsw

Path C:\Users\Admin\Desktop\TraceConvertTo.vsw
Size 653KB
SHA256 b921ca95a28be83b9aadb6eabaf0bf66d91ca575f9dd6e0c61ac39be6022695c
MD5 a1800c75512fdd77e3999984a33ee355
SHA1 4905f1d4b3ec515ce844acd091280b231339e542
SHA512 80fe525d8feda578d2acf3911dfa7a62b913da4f5d8f70c3e33dce807414436e60a9712032af6cfbcac301ebcaf897de682d9f46882a52eb1a0dcf7346c2c3fb
SSDEEP 12288:uuQqO0OlzWxXqOhdwv7rEde9tpa+XodzUJu7uUVbL5yPeup7F3ACMuoyhckrC1XD:uu/IzW5QX0e9T4WJu6PeuVF3Tfz8FBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnlockSet.easmx

Path C:\Users\Admin\Desktop\UnlockSet.easmx
Size 413KB
SHA256 00f3a47987bf0700be7a8c7ee2fa2c293794743b5a43b44a06a26b8c617978d4
MD5 26a8c93109bdd7184dc45d9ec5035eb4
SHA1 8234b218fdd27e55e3e3c8dfa6a5274593d40340
SHA512 40c74ca9ab0e5ac90de0962e46398a048a5f2bf67aacde2afc1e5c90502078007f107e12b71035cbd9747265e3cf7a2a8650f6475d3594a44eabeb219ca90325
SSDEEP 6144:5ggmpNtVLfAjj0YEKGt8g39ndwP4UEh9jUUAIwNsrnApktSV3gIz1RqjIHxwAWxj:dIbjAkYE4Ado4VaBmtKwEycRbW1zX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaitSync.ttc

Path C:\Users\Admin\Desktop\WaitSync.ttc
Size 1.0MB
SHA256 6b353ff59193e702c6e04d253da98b8caf73ebe6032f24ef634342ca257ab335
MD5 56902bcb05898203df5b7b5a6077311d
SHA1 6723611fa4a6d9bc40afde468d9b677965ee841a
SHA512 ace5cb1ee8ef803158c74e0a11488959fc4a56788be9a3a74eb68b91bcea81126e288a27c3f59c3147f2e6487cf8abd507bf6bdc878318eedced9779de2b4c9f
SSDEEP 24576:f/8QCflLxNdgU0fIjmfgsVXJSlMgOtVArIdIZkmrH90qE/uJ:f/8QCV0fYmIeX5BVaIdIdBEGJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaitUnpublish.cr2

Path C:\Users\Admin\Desktop\WaitUnpublish.cr2
Size 787KB
SHA256 38e237845932aa8641d80c543a6ce99be456249803ef39af1c03a3804a3688e2
MD5 0ce37103f6980ffe7d3ddf8f14b0b52e
SHA1 7210c2f468c06e41ad66d232b1cffbd56e70c72d
SHA512 7aea42bf33ac87465d15bf6c266b23b9b0eceb8521dbc74c33ad9e4624beee4d49ca8c74a821010e223f3292becd4e424c9c7ea2c04fb91d5cacf737b3c8821b
SSDEEP 24576:2pfDa9v4r2wOEWZv3wcaWFBrvNSlW0kdb3KES:YGvwW5LBrvNr0kdLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

WatchConvertFrom.wps

Path C:\Users\Admin\Desktop\WatchConvertFrom.wps
Size 813KB
SHA256 fabdab79342811de6c7cd3a109593b43d15fa8ff491072eb9848fa84dc60eb7c
MD5 b16476ac42154e3fc2068add43edb042
SHA1 ab6657f40b070660acc79f1e6b88c644f909c6de
SHA512 ba126dda476c7a0988445ca78dbaf714a9f3d6c74734cb4f8376c766a9d0aa64a6c556a858df3dc07bf1d13c3b1b23677245c630879a6b8128ff5c5863ceab69
SSDEEP 12288:I2TeEQlB2vBy+6qNDsbFzHjLR4uA1MKG4WwUgkKSm6pVoEGTqW6X1By:DYroB/NYbFVpKXG9TpWtqRX1By
MD5 SHA1 SHA512 SSDEEP

Submit Download

WriteStop.eprtx

Path C:\Users\Admin\Desktop\WriteStop.eprtx
Size 1000KB
SHA256 8e81ea424122da2e3773a1aec1755995852d2725fbb478e69adf1f300c14b343
MD5 e384c413c1112039a8903bb9afa2d650
SHA1 41bdf77f0d5d810491a9525fa8532ac874aed648
SHA512 171a801e8430690e34649bda8bf0d3a571c542325505fb4414e0d06b0932b10d96fcb7935f43692544ee1c7e83aa1a535730a5509ccdb1e28d203e09e6e90f54
SSDEEP 24576:Rb316ciiJZyQFURXsKMA7Ixvz/qB+R5eAdyTQ+CYnDYMLRLvM:RbdZyJsA7Wrx5eAdaCYDYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

MalwareDatabase-master.zip

Path C:\Users\Admin\Downloads\MalwareDatabase-master.zip
Size 80.3MB
SHA256 8958b12524fe2dd23a2415792a0ce43a41f7b83bfee2720878319194d43001c4
MD5 324f1ced7ab187d28f8949181999216a
SHA1 06b6c8206482f855e8a1e78c6e8e1500d1fcf8a6
SHA512 4dfe613964a4efdc22d1d25bc5533a1457d9647056b32c2d12728d10505fa7834160b2b4a17db85b679fad1ec7b19165ebf907c74f47d6756dd7c6475fe080db
SSDEEP 1572864:9LeGhtVJYH0I5n7tGFvlsnPqKMVUqqYifHkZWFZKrW2QAeUKZb838:9LfhXJVIBzzYgk0FZuW2QOK08
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 7fe16154d30a2515e344b61875f8267e2258eaa9c8c5ff87fa25f08f2404b56b
MD5 b0f869458ced3bac80c8adf82bfa00f1
SHA1 ab8de02f3659918277552e6fff7429961870f51b
SHA512 ee87a8491f1c16bdfc923977ba00c111c9b61c86bdc43ae9cdfedb2b62a46e7c149bce887ba7090c011423a0308cfbdb0402eaecdabb8117df674df3b7c2b938
MD5 SHA1 SHA512

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1000B
SHA256 d4752d7766019dc6aeba9c8e962e826c4287d09fa519bc5dae34e4fd1f9b3569
MD5 adfdb491e4a8f583b6006097046fabc8
SHA1 90850e974a530b5238a12c07740901c1f83b93d3
SHA512 ef1fff0f561679c205b3cd674263147c223d3e0557fe14618aec94f2162db412ba81b087d75baf7a881a183a3482f95cf76360c16c02908db469ab490058346e
MD5 SHA1 SHA512

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 afc6c7e86d7fe3177e24f063d630a11ae6b69a0d662f348891433f7d038c6312
MD5 cad4431c598b042c589fb1ec55002c9f
SHA1 747d63a643f766638a0a5086223d728bb46bf976
SHA512 4949c692960c4bc991dcb53ee53b2c2394359ab5a479fb2f340b9788c4cc41558cf4752b62083ee95bfdad57ecf2da8f7c84431f12e0f890c0aae44281ce3698
MD5 SHA1 SHA512

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 bec8169c0bc65e9901dc1580f0e7c4b7a6ada2b3227792432edf3c5e3dd52e02
MD5 80878b397abf6ebb058691fc2404e5b5
SHA1 6e54d8f08b6885101f486f764192e26b001e27ae
SHA512 e5d0629f1217423987bbeeb81e37b4169e0af085b2da76b1cc488bdc22cba481168092946a46a695c81a6dd0d9dc1f6b005a3f4fa9545a8cedbc116689d5f4f1
MD5 SHA1 SHA512

Submit Download

memory/344-669-0x0000000000720000-0x0000000000721000-memory.dmp

Download

memory/344-670-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1948-7-0x00000000007B0000-0x0000000000868000-memory.dmp

Download

memory/1948-8-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1948-5-0x0000000010000000-0x0000000010030000-memory.dmp

Download