agenttesla | 31c88f1dea1927be5a3cadd19686e09cbf475e0ac7b9283205f3ea58f71f3dc4

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
testss.html
Size 228KB
Sample240404-mdjdkscc51
SHA256 31c88f1dea1927be5a3cadd19686e09cbf475e0ac7b9283205f3ea58f71f3dc4
MD5 ff0d08650c79862dd63c2c5e3e16e99e
SHA1 2124ff41f857dc8f235a5e1708c1ee06c4fefd93
SHA512 efdeb26c84de4e7bf94239bf10b76703585e414382d3df14ef9bc67a7b8f67dd0701fd9a1b2cf71dc00ba2b233a268710e3c3d873d5a492b7f2afa8f6d24842e
SSDEEP 6144:t9gVV9FFAg+uoYsXWPUjR5+EiErKEpp9ECIflI:jOV3ziY3sS9ErRRsI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://discord.com/api/webhooks/1221964625558634546/LYCfhRMt-_L7CYz17GTgeoz-NOnf0kKI3_e9LEiP9Ehqqf6jDcePJrDgFkcbX0aKbQCd

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Executes dropped EXE 19 IoCs

pid	Process
2608	doc20240204070611.exe
3432	doc20240204070611.exe
3588	doc20240204070611.exe
4724	doc20240204070611.exe
1992	doc20240204070611.exe
1016	doc20240204070611.exe
4656	doc20240204070611.exe
3432	doc20240204070611.exe
1640	doc20240204070611.exe
2304	doc20240204070611.exe
4416	doc20240204070611.exe
396	doc20240204070611.exe
1576	doc20240204070611.exe
4956	doc20240204070611.exe
4212	doc20240204070611.exe
1616	doc20240204070611.exe
1736	doc20240204070611.exe
804	doc20240204070611.exe
4892	doc20240204070611.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
66	discord.com
69	discord.com
65	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
62	ip-api.com

Suspicious use of SetThreadContext 19 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 4888	2608	doc20240204070611.exe	126
PID 3432 set thread context of 1620	3432	doc20240204070611.exe	125
PID 3588 set thread context of 1040	3588	doc20240204070611.exe	129
PID 4724 set thread context of 4124	4724	doc20240204070611.exe	131
PID 1992 set thread context of 4700	1992	doc20240204070611.exe	133
PID 1016 set thread context of 2552	1016	doc20240204070611.exe	160
PID 4656 set thread context of 2580	4656	doc20240204070611.exe	140
PID 3432 set thread context of 548	3432	doc20240204070611.exe	142
PID 1640 set thread context of 3376	1640	doc20240204070611.exe	143
PID 2304 set thread context of 2588	2304	doc20240204070611.exe	147
PID 4416 set thread context of 932	4416	doc20240204070611.exe	150
PID 396 set thread context of 3712	396	doc20240204070611.exe	151
PID 1576 set thread context of 2524	1576	doc20240204070611.exe	156
PID 4956 set thread context of 3180	4956	doc20240204070611.exe	158
PID 4212 set thread context of 1408	4212	doc20240204070611.exe	162
PID 1616 set thread context of 4724	1616	doc20240204070611.exe	163
PID 1736 set thread context of 1668	1736	doc20240204070611.exe	166
PID 804 set thread context of 3808	804	doc20240204070611.exe	171
PID 4892 set thread context of 2524	4892	doc20240204070611.exe	173

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2100	4416	WerFault.exe	144
528	396	WerFault.exe	145
1408	4724	WerFault.exe	163
5084	2524	WerFault.exe	173

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
3592	msedge.exe
3592	msedge.exe
2976	msedge.exe
2976	msedge.exe
760	identity_helper.exe
760	identity_helper.exe
2608	doc20240204070611.exe
2608	doc20240204070611.exe
3432	doc20240204070611.exe
3432	doc20240204070611.exe
2608	doc20240204070611.exe
2608	doc20240204070611.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
1620	Caspol.exe
1620	Caspol.exe
1620	Caspol.exe
3736	7zFM.exe
3736	7zFM.exe
1040	Caspol.exe
1040	Caspol.exe
1040	Caspol.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
4124	Caspol.exe
4124	Caspol.exe
4124	Caspol.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
4700	Caspol.exe
4700	Caspol.exe
4700	Caspol.exe
3736	7zFM.exe
3736	7zFM.exe
2552	Caspol.exe
2552	Caspol.exe
2552	Caspol.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
4656	doc20240204070611.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
4656	doc20240204070611.exe
3736	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3736	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeRestorePrivilege	3736	7zFM.exe
Token: 35	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	3432	doc20240204070611.exe
Token: SeDebugPrivilege	2608	doc20240204070611.exe
Token: SeDebugPrivilege	1620	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	1040	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	4124	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	4700	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	2552	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	4656	doc20240204070611.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	2580	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	2588	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	4416	doc20240204070611.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	396	doc20240204070611.exe
Token: SeDebugPrivilege	1576	doc20240204070611.exe
Token: SeDebugPrivilege	2524	Caspol.exe
Token: SeDebugPrivilege	1736	doc20240204070611.exe
Token: SeDebugPrivilege	4724	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	804	doc20240204070611.exe
Token: SeDebugPrivilege	3808	Caspol.exe
Token: SeSecurityPrivilege	3736	7zFM.exe
Token: SeDebugPrivilege	2524	Caspol.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe
3736	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1760	3592	msedge.exe	86
PID 3592 wrote to memory of 1760	3592	msedge.exe	86
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 4044	3592	msedge.exe	87
PID 3592 wrote to memory of 2140	3592	msedge.exe	88
PID 3592 wrote to memory of 2140	3592	msedge.exe	88
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89
PID 3592 wrote to memory of 1032	3592	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\testss.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabf3f46f8,0x7ffabf3f4708,0x7ffabf3f4718
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\doc20240204070611.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3736
- - C:\Users\Admin\AppData\Local\Temp\7zO89E966D8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E966D8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:4920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:2300
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:4888
- - C:\Users\Admin\AppData\Local\Temp\7zO89E207D8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E207D8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:756
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1620
- - C:\Users\Admin\AppData\Local\Temp\7zO89EE41D8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89EE41D8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3588
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1040
- - C:\Users\Admin\AppData\Local\Temp\7zO89EE27C8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89EE27C8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4724
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\Users\Admin\AppData\Local\Temp\7zO89E684C8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E684C8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1992
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\Users\Admin\AppData\Local\Temp\7zO89EE62C8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89EE62C8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1016
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\Users\Admin\AppData\Local\Temp\7zO89EAF2C8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89EAF2C8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:3544
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\Users\Admin\AppData\Local\Temp\7zO89E260C8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E260C8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3432
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:548
- - C:\Users\Admin\AppData\Local\Temp\7zO89EA21C8\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89EA21C8\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1640
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:3376
- - C:\Users\Admin\AppData\Local\Temp\7zO89E18E39\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E18E39\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2304
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- - C:\Users\Admin\AppData\Local\Temp\7zO89ECEF39\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89ECEF39\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 940
      4⤵
      Program crash
      PID:2100
- - C:\Users\Admin\AppData\Local\Temp\7zO89E27D39\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E27D39\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:396
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 944
      4⤵
      Program crash
      PID:528
- - C:\Users\Admin\AppData\Local\Temp\7zO89ED4A39\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89ED4A39\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:2356
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\Users\Admin\AppData\Local\Temp\7zO89E51B39\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E51B39\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4956
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:3180
- - C:\Users\Admin\AppData\Local\Temp\7zO89E06839\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E06839\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4212
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:1408
- - C:\Users\Admin\AppData\Local\Temp\7zO89E1E639\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E1E639\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1616
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 2260
        5⤵
        Program crash
        
        PID:1408
- - C:\Users\Admin\AppData\Local\Temp\7zO89EBE739\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89EBE739\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:3784
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:1668
- - C:\Users\Admin\AppData\Local\Temp\7zO89E38879\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E38879\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:804
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      PID:3712
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3808
- - C:\Users\Admin\AppData\Local\Temp\7zO89E8C679\doc20240204070611.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89E8C679\doc20240204070611.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4892
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 2264
        5⤵
        Program crash
        
        PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15793407710575468635,1282702461385281048,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4416 -ip 4416
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 396 -ip 396
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4724 -ip 4724
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2524 -ip 2524
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

doc20240204070611.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\doc20240204070611.exe.log
Size 410B
SHA256 d9c6d00fad02f7a9ef0fcddc298ffd58b17020fb12b1336d5733237cbfadb1e0
MD5 3bbb825ef1319deb378787046587112b
SHA1 67da95f0031be525b4cf10645632ca34d66b913b
SHA512 7771ae543e188d544e1bb6c65e0453a6777c1c39790a355f4cce652a815bfaf94dd426de3db910a67bd06e463ac0143d9e2ca44d2b12af7f0d84c27b4a09cc54
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3d7aa96d3cd5b9cef0d242cc575f59bcad2093ae90978ace910693af3523b4a0
MD5 02ae44e2e145c2d3ee369b86d43fc858
SHA1 8fb54901538111fa4151d39b01669bbc36ac9842
SHA512 a4cc02091897da1a9ae595da9a08879e41d90f6b59c2e51059c83c298d780dfcadefd4baae6ea693685950920a07a0d0ea0a0daef9b2fed8f183e4bbea220703
SSDEEP 96:nekQSh1DDUwpvWMoiVmdeH0Qzs+UWQyV+VD7ziEwb:nek5BUGWMXds+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e8a8a5eb80ddcfe518ee31dd07da4a3c1e81a271710abeecde3705b614f3177a
MD5 815e9430caac0869e468edb9b86f33e0
SHA1 c5f9d1745303786c69f94e29614e94e09113f2c4
SHA512 1c3f0b985056eb93e35213746efe5c8e046f2bcc8f95d2e7541c735679c125847ac5b7f090a6a8d179b7d1c5746a91f70ac34c368a6b84b2964e96a430365e52
SSDEEP 96:nek8sQtSh1DfUwpvWMoiVmdeH0Qzs+UWQyV+VD7AiEwb:nekHhUGWMXds+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 34162b428e79d6e723055af7aca05a1563b9f77266a75f3fbd12930c1d065da0
MD5 32df209af1c9f8b655a3a650ee76396d
SHA1 b1517d26ff70b74e332608912705059b89040d13
SHA512 207f8ce0e5f7ba03cee3229e6392d1f63fcd8e7f3015632555addfd8d4f467b448573f3020217ca8a376274bddba490e35c885a42b8cde3ff28ff67f50492588
SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQ6YSe2RULApWtoOybXyGj2:69iIxuERzA83h09RZxYr5pxPyiMJzV+g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 304a1eb35de9dc538caf9dcccf63c2ba2023b7e98a67e6d37241117bb39ed04d
MD5 b47da882a6241028933973038b2bbb13
SHA1 a98bb8c3914d029a364c620a96bee4cf359f12c6
SHA512 6d09c0d5b2db93930feb8a5ad35af148ed25b6c0de08b88aa0edb8557e5552919fc6f49ef92ef80adc0e5e497d705e326b443b1157e28e97e6a84c54043bb95c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQ6Yle2RULxbXWGjKFGOz0o:A9iIxuERzA83h09RZxYS2WiMJzV+g
MD5 SHA1 SHA512 SSDEEP

Submit Download

doc20240204070611.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO89E966D8\doc20240204070611.exe
Size 199KB
SHA256 281158a6904cc242dd11060cdfc872847c1070be776fe1705d7a14d1bd7ab7dc
MD5 18b0fd42f2c7790426f338a124a319d0
SHA1 8232517793daaedc3d8d1bd7259e485ff9e926a5
SHA512 d7fd81c5d94f081f37600da657d0b2f386b106af8d885f084ecb77af4069cda47de53a1a918ef7535314282d8bd84da753b83afced491aaac0bece6f9d4b68de
SSDEEP 3072:2jqsJ1r/D2ZAEsn63IZJ0EGVsuo/bgMGGpQ483T7GmCMY7pdkZ:2je7snqI2PozTQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

doc20240204070611.rar

Path C:\Users\Admin\Downloads\doc20240204070611.rar
Size 170KB
SHA256 be433ba81e3f78a1407673168d2476ef32c96ee6791d554821cdae38ec76aa04
MD5 4d9918e8c6b6bfe4f8372887b9db92e7
SHA1 1008a20f46e13ed5da3a128bf931f0334827bbf1
SHA512 40ae91783f334ddc228c7251ffffc435f1076fd62d4c1afb194f699d687a5e48cb4c1a0b345728ab7b3023ee265b9bbfbac9b49330aba802fe7090c33c0e2d87
SSDEEP 3072:D0a71zr2DnuDef+MmAXYBDOLqq1yAG3za2jfY8bDHPL6ERCTEKdvISae:D0aZvWK8bmgUDhkYfAiDvOERCTH3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-351-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/548-329-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1016-273-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1016-250-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1040-182-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1040-183-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/1040-223-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1576-366-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1576-377-0x0000000000B70000-0x0000000000BA6000-memory.dmp

Download

memory/1620-184-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1620-158-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1620-162-0x00000000051E0000-0x0000000005246000-memory.dmp

Download

memory/1620-163-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/1640-320-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/1640-352-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1640-299-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1640-298-0x0000000003000000-0x0000000003036000-memory.dmp

Download

memory/1992-248-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/1992-224-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2304-380-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2304-313-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2304-369-0x0000000005080000-0x0000000005090000-memory.dmp

Download

memory/2552-336-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2552-285-0x0000000005240000-0x0000000005250000-memory.dmp

Download

memory/2552-274-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2580-335-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Download

memory/2580-316-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2588-381-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2608-148-0x0000000005080000-0x00000000050B6000-memory.dmp

Download

memory/2608-145-0x0000000000640000-0x0000000000678000-memory.dmp

Download

memory/2608-159-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2608-151-0x00000000050F0000-0x0000000005100000-memory.dmp

Download

memory/2608-146-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/2608-152-0x0000000002B10000-0x0000000002B1A000-memory.dmp

Download

memory/3432-153-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/3432-305-0x0000000005590000-0x00000000055A0000-memory.dmp

Download

memory/3432-270-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/3432-147-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/3432-149-0x0000000007A50000-0x0000000007FF4000-memory.dmp

Download

memory/3432-150-0x0000000007580000-0x0000000007612000-memory.dmp

Download

memory/3432-340-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/3432-160-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/3588-181-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/3588-179-0x0000000002A30000-0x0000000002A40000-memory.dmp

Download

memory/3588-178-0x0000000002950000-0x0000000002986000-memory.dmp

Download

memory/3588-177-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4124-212-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4124-255-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4416-397-0x0000000004A40000-0x0000000004A50000-memory.dmp

Download

memory/4416-339-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4656-287-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4656-254-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4656-315-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4656-265-0x0000000004FE0000-0x0000000005016000-memory.dmp

Download

memory/4700-286-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4700-240-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4700-253-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Download

memory/4724-206-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4724-207-0x0000000001940000-0x0000000001950000-memory.dmp

Download

memory/4724-211-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4888-161-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4888-154-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4888-166-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4956-378-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/4956-382-0x0000000002DB0000-0x0000000002DE6000-memory.dmp

Download