remcos | hxxps://store2[.]gofile[.]io/download/direct/d7bffa84-89ff-43a9-9bd7-9513720de243/Teen%20Girl%20Leak%20Porn9[.]js | Triage™

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://store2.gofile.io/download/direct/d7bffa84-89ff-43a9-9bd7-9513720de243/Teen%20Girl%20Leak%20Porn9.js
Sample240405-3fca2sfc93

Score

10^/10

remcos rhadamanthys ads collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

4.9.4 Pro

Botnet

ads

C2

rm.anonbaba.net:3392

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-S3THB5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 5332 created 2428	5332	file.exe	43
PID 5600 created 2428	5600	file.exe	43
PID 4296 created 2428	4296	file.exe	43
PID 5540 created 2428	5540	file.exe	43
PID 4820 created 2428	4820	file.exe	43

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/5872-237-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/5872-245-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/5872-246-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/5136-231-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/5136-238-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/5136-256-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral1/memory/5136-231-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/5872-237-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/5180-239-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/5136-238-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/5180-235-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/5872-245-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/5872-246-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/5136-256-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 27 IoCs

flow	pid	Process
36	5172	WScript.exe
38	5244	powershell.exe
41	5440	WScript.exe
42	5492	powershell.exe
43	5696	WScript.exe
44	5836	WScript.exe
46	5492	powershell.exe
49	5804	powershell.exe
54	5548	WScript.exe
55	5192	powershell.exe
59	5932	powershell.exe
60	5760	WScript.exe
61	5192	powershell.exe
62	5932	powershell.exe
63	5804	powershell.exe
82	5652	WScript.exe
84	1096	powershell.exe
85	1096	powershell.exe
88	5420	WScript.exe
89	1660	powershell.exe
92	1660	powershell.exe
93	1296	WScript.exe
94	5728	powershell.exe
95	5728	powershell.exe
103	5212	WScript.exe
104	5832	powershell.exe
106	5832	powershell.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RunBatchFile1.lnk	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
6092	utility.exe
6128	utility.exe
5136	utility.exe
5872	utility.exe
5180	utility.exe
5332	file.exe
5600	file.exe
4296	file.exe
5540	file.exe
4820	file.exe

Loads dropped DLL 7 IoCs

pid	Process
6128	utility.exe
6092	utility.exe
5332	file.exe
5600	file.exe
4296	file.exe
5540	file.exe
4820	file.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

Email Collection

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	utility.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 6128 set thread context of 5136	6128	utility.exe	137
PID 6128 set thread context of 5872	6128	utility.exe	138
PID 6128 set thread context of 5180	6128	utility.exe	139

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 534535.crdownload:SmartScreen	msedge.exe

Script User-Agent 10 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	88	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	93	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	41	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	54	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	82	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	103	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	44	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	60	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
3660	msedge.exe
3660	msedge.exe
2580	identity_helper.exe
2580	identity_helper.exe
1864	msedge.exe
1864	msedge.exe
5244	powershell.exe
5244	powershell.exe
5244	powershell.exe
5492	powershell.exe
5492	powershell.exe
5492	powershell.exe
5804	powershell.exe
5804	powershell.exe
5244	powershell.exe
5244	powershell.exe
5492	powershell.exe
5492	powershell.exe
5804	powershell.exe
5192	powershell.exe
5192	powershell.exe
5192	powershell.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe
5136	utility.exe
5136	utility.exe
5180	utility.exe
5180	utility.exe
5136	utility.exe
5136	utility.exe
5272	powershell.exe
5272	powershell.exe
5272	powershell.exe
5492	powershell.exe
5492	powershell.exe
5332	file.exe
5332	file.exe
5972	dialer.exe
5972	dialer.exe
5972	dialer.exe
5972	dialer.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
1096	powershell.exe
5600	file.exe
5600	file.exe
2088	dialer.exe
2088	dialer.exe
2088	dialer.exe
2088	dialer.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
4296	file.exe
4296	file.exe
5392	dialer.exe
5392	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5776	OpenWith.exe
1788	OpenWith.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
6128	utility.exe
6128	utility.exe
6128	utility.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	5192	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	5180	utility.exe
Token: SeDebugPrivilege	5272	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
3996	mspaint.exe
3996	mspaint.exe
3996	mspaint.exe
3996	mspaint.exe
6032	mspaint.exe
6032	mspaint.exe
6032	mspaint.exe
6032	mspaint.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4940	3660	msedge.exe	86
PID 3660 wrote to memory of 4940	3660	msedge.exe	86
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 5076	3660	msedge.exe	87
PID 3660 wrote to memory of 1968	3660	msedge.exe	88
PID 3660 wrote to memory of 1968	3660	msedge.exe	88
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89
PID 3660 wrote to memory of 4708	3660	msedge.exe	89

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2428
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5972
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5392
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store2.gofile.io/download/direct/d7bffa84-89ff-43a9-9bd7-9513720de243/Teen%20Girl%20Leak%20Porn9.js
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff86b846f8,0x7fff86b84708,0x7fff86b84718
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16806769923696220732,14689223045955786936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:396
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\ExtractedUtilities1\run.bat""
      4⤵
      PID:6060
    - - C:\Users\Admin\ExtractedUtilities1\utility.exe
        
        "utility.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6092
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\ExtractedUtilities1\run.bat""
      4⤵
      PID:6080
    - - C:\Users\Admin\ExtractedUtilities1\utility.exe
        
        "utility.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:6128
      - C:\Users\Admin\ExtractedUtilities1\utility.exe
        
        C:\Users\Admin\ExtractedUtilities1\utility.exe /stext "C:\Users\Admin\AppData\Local\Temp\kinjqpjmylhonesrtjqzd"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5136
      - C:\Users\Admin\ExtractedUtilities1\utility.exe
        
        C:\Users\Admin\ExtractedUtilities1\utility.exe /stext "C:\Users\Admin\AppData\Local\Temp\ucstrzbomuzbykovducsgbau"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:5872
      - C:\Users\Admin\ExtractedUtilities1\utility.exe
        
        C:\Users\Admin\ExtractedUtilities1\utility.exe /stext "C:\Users\Admin\AppData\Local\Temp\fefmssmhacrgayczmfxuroulqxs"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\ExtractedUtilities2\run.bat""
      4⤵
      PID:4024
    - - C:\Users\Admin\ExtractedUtilities2\file.exe
        
        "file.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5332
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\ExtractedUtilities2\run.bat""
      4⤵
      PID:5008
    - - C:\Users\Admin\ExtractedUtilities2\file.exe
        
        "file.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5520

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:5420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\ExtractedUtilities2\run.bat""
    3⤵
    PID:1356
  - - C:\Users\Admin\ExtractedUtilities2\file.exe
      "file.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4296

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Teen Girl Leak Porn9.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\ExtractedUtilities2\run.bat""
    3⤵
    PID:6084
  - - C:\Users\Admin\ExtractedUtilities2\file.exe
      "file.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      PID:5540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Teen Girl Leak Porn9.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
PID:5212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tempScript.ps1"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\ExtractedUtilities2\run.bat""
    3⤵
    PID:2876
  - - C:\Users\Admin\ExtractedUtilities2\file.exe
      "file.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      PID:4820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5776
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Teen Girl Leak Porn9.js"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:3996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5388

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Teen Girl Leak Porn9.js"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:6032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1788
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\Teen Girl Leak Porn9.js"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  PID:5596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:4556
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=675B55F4C68C8CA98A669FA14C5014C5 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2683CBA7ED6E1497E9834C8CC09BCF56 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2683CBA7ED6E1497E9834C8CC09BCF56 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=87E6E12960BE05E70A29F5FCAF92DEA9 --mojo-platform-channel-handle=2196 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=17CCB14E02F5CD5E966DE47C44DE75C6 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36841EB40408A348850233F0E4629F1B --mojo-platform-channel-handle=2000 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1A65CF7DB673CECF35B9C6EA803823C1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1A65CF7DB673CECF35B9C6EA803823C1 --renderer-client-id=8 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 87da8febb5044a5a996702455d0ef3274befe803546da6f7f352ca534a1ea8e0
MD5 d2b4b35bba11df64c2188d40f64a7c56
SHA1 e21a1a0b26369a166d90b2df3f9a4cb2fe4687a0
SHA512 dbc1c4ee67fc8a5d7e098519adaba6bf7683291fbcbcc2c13175c3733e7be8a7b788addf8096360a074ca464f30968aa0aa1afb634c16b02db9943d5d360a9cc
SSDEEP 96:nhikyx6182wpvWMoiVmdeHOHTs+QUWQyV+VD7ziEwb:nIkfK2GWMXETxQrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c307809f03b5e6a679eee51c08dbe276dde365a138397183cf21d9a226539ec8
MD5 238183b99ab8be5a4697cad1f2e5e7c1
SHA1 90ee1bf2a28172409be9c6d4d3175497a3021b52
SHA512 7e900515231de25610ce37b3c7a3cb5f44724ef1d10f23421dce60ffc9c19d5ac4fcf11ca07aeaa93443f4220b237386c3d8dae21a8335156d9e7d2b96cd273f
SSDEEP 96:nhik8sQTx6182wpvWMoiVmdeHOHTs+QUWQyV+VD7AiEwb:nIkhK2GWMXETxQrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a1b2ce7d76ae74e1a203ce75523ca63ae3133068cc8afdbb07ca19d297746ee0
MD5 4650a437d36208105003e67dd6878b04
SHA1 6f9fbc631e73ce3f68e0f2c257682062f5d70696
SHA512 e08184e66c04b73671a00162661ee99eccc9cc941ed1f4fddbd0a13933cbc3952bc2de085b7f85abdd5ca6497f68f1fd194c4952002b88c505b613cbf3bde37e
SSDEEP 96:nhik8sQqx618SwpvWMoiVmdeHOHTpC9yWQyV+VD7AiEwb:nIk6KSGWMXETM9lg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 30000c58c6cc67c5cae7b464bdaf5adaeaff36dda44c14a00721ab0cbc63f139
MD5 5ab08848d295cdda7440e056d4cf3190
SHA1 864fdaa6dd90df0872705e848900b4a5f81e6591
SHA512 761dd54add61d5ef5dbc0f61c2642347ac1ca2c95370b483a520c18d528a2f9ec4b2bec36c5a463304c9f9164d7e1cf0519fe7d6509a9dc529d7c7aa22f8f216
SSDEEP 192:IoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupce2RUDybRRxvFt2pTEEjxW:w9iIxuERzA83h09RZxYCXRTt2h3Co4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9bed8254c27e9687e382940fdbe2ab779c7e6db3d565fed701a78a0832e6fab1
MD5 b1a5e35b84bfb6c83b6961ea779ddfba
SHA1 63647f18d72e0acba82c7e993b8e261cc8e9fa23
SHA512 161d0833869ce73530f74030f06b7ef95e55070dc81d92cd83675a909784d9671ae43114d86d6feba20a8afdd634d4f9cb0798a3b6fc0d657457d3086e5aea8e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQe2RUbybROxvFt2pTEEjxW:A9iIxuERzA83h09RZxYOlOTt2h3Co4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c019f476fbbeb3bab98116f8d122d6314f4d924a09eb50bf6b049028b02ebb2e
MD5 367fdca7d3dadbc793710db57784d6a9
SHA1 29c66e793d0b649ae426ba3721fa325009898684
SHA512 d609b2132262c05798967c18f771969a5438755a45c487d4d0a6ab8c184c9ef3fa2387e7dd8c8ee25dfb730a1a0a4dfeca9f6558fa80b2346ebefd85776da2d8
SSDEEP 192:3oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQe2RUbybRcxvFt2pTEEjxW:P9iIxuERzA83h09RZxYOlcTt2h3Co4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
MD5 6c47b3f4e68eebd47e9332eebfd2dd4e
SHA1 67f0b143336d7db7b281ed3de5e877fa87261834
SHA512 0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4abf82d097b10fe9883e3869aadf011205d15882ac44d32fca3fff82af141e1c
MD5 8e965d0169fe1ac12a27374de36eaa2e
SHA1 9617b89be60c7f5c254911c19a1fee06ca19105d
SHA512 b7536eaad369ea58ede58b4e6764b61d84f8207a4082846c9c93b16f4c364f8c7d83e198bdcd3ee9e72d306d325d69948b54de5d74b75b9357308e77452361d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 47540bf52bad88f132411bc67d473caecedc3bf329434f006b54710492019405
MD5 33a5582d19d967ee5af5e4faf5b470cd
SHA1 232581ae8550d0bd670e409610aeb831f7d95a08
SHA512 cf064ede82004ac51abfbd9190cf77d3c71438ec3d6759b50e9cb33a18c4ebe79c450bcbf083427dac31cafcf10a366e92c9496cc24ef92e8680cedf4f230d1a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 87a0ea4f4da4be01a78f17b0bc345b323fa89e23b9c822f5b9fb331041ae5f90
MD5 8a544f3a42aec20fd34799cca9266219
SHA1 19214f41f76c34e09ae62944dd071f3eff3973df
SHA512 30732284cd064f29dd09b6db49c1e6edf6af4e1b0dc7fc31e7a589a7f586e195acfdd12bb56590f191f78ded6a066987928cb6a376891fa58ba6879ba439218e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c7eee96a62af86d9050317c6deb0e0e396df0060ce58d3c9fd93ab663dafdeb4
MD5 f623cb675b3953f6b334281b1214c46f
SHA1 398c687963e2147bca6a4804318b74094458ef7e
SHA512 7784f928c2460f0ece62834b4457aadcc1d05052d055bffe1af20f215d51fdf474013c7ac2769fb00fd201b33eddff1a62089ffa36787b29ec7f82916b40bcef
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_jwwtd2ko.lbw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jwwtd2ko.lbw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

kinjqpjmylhonesrtjqzd

Path C:\Users\Admin\AppData\Local\Temp\kinjqpjmylhonesrtjqzd
Size 4KB
SHA256 30190665467845aed54732c31c7e385368c10acb595cffdd7ca9523fff051a19
MD5 ec0cf9ff722f9a9259c3338972c40886
SHA1 31bad5285affb58c5ebe0569bbdb9bd1deab245c
SHA512 bdfaf9576db431d3c4d14e0ea5deafce661fceda6d5123a6f4b84d50a576dd1ccf4202091dc0b55bed665dd45b4e30d2a797bda6015b06f5771064f9bab32d1a
SSDEEP 48:wvvv0oOgxfvvcoOgxfdvv0oOgxBvv0oOgxakvv0oOg7:mv4gxvwgp1v4gPv4gbv4g7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tempScript.ps1

Path C:\Users\Admin\AppData\Local\Temp\tempScript.ps1
Size 2KB
SHA256 140ac47d172a0f6660530306468d15cb4b97248a29dd7d68510754158585bf82
MD5 5983717fc6d7ee69b9f384c329c7953e
SHA1 12509f1c32fb836185a3c7bf980b6edaa74f962f
SHA512 429e022020fd2d83624bdb8cde17ce20051709ca5371b1d0acc278f60956a07ffa6c4583a79a7aab019be6cc21441a11b562e5c0ea98f3eb6cf0ba8d2377498e
MD5 SHA1 SHA512

Submit Download

Unconfirmed 534535.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 534535.crdownload
Size 2.9MB
SHA256 dcce666d48359add5a2b3e32717d5990362bde12b0204e999b69026da0d29ca7
MD5 c7bf73cc78d26ca413729649513a764f
SHA1 715c72c5f56fe85d435b7890bf02a95c86616fdf
SHA512 99bc2056058772f39f7207b1529f95b5e5a86fe758cd46f4624595d9d921d4ef3b3168b247d68f2d8e810c4e47145e0f81c09e4d26b6a3bf6583abce9906e8ab
SSDEEP 48:yffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff1:lQRlJE8Iu8uBhTU/TQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.bin

Path C:\Users\Admin\ExtractedUtilities1\data.bin
Size 471KB
SHA256 b50013a2b0c74ed1ca53a8f29eb38e9d5f53855c26aac2a8f848754110bdc056
MD5 acf3c00362de1bc620b5ea883912deb3
SHA1 71384b0f54b1b5a41061ce14f6f1994f9783d322
SHA512 1848d32918564504b3bd77d214d0a51225232ffc36e338b9da928558cc4927c8710f74acb273235bb7076852d2636c662b8112a96275c52a262ec3016eac6648
SSDEEP 12288:wGagwRXRPqC5XLFWCKd0IR/9qhJkMk91ec/7DDY7NhWdsmhX:wGWBPqC5XEnZR7TeSrY7n6vN
MD5 SHA1 SHA512 SSDEEP

Submit Download

g2m.dll

Path C:\Users\Admin\ExtractedUtilities1\g2m.dll
Size 399KB
SHA256 93439fe9b45d7b6e9fcdc5e68fd47677ea17025e4eabb6f1468cb9ae98ee8a5b
MD5 326683813b145cc5469dff1f77c701e3
SHA1 b31eb0e91c6e70719a15dd61e7e374ce2b7782c1
SHA512 981bf18aa03259a557eed4fc336d27f3f55b3a0421e70b6b59c5ef9753be885b537d5e55f2d58753621b57aa6079708d35732edddd4d97d4891b79600e631fc3
SSDEEP 6144:u9rSWpovUahUzo+NY7+c2wkYUL8NuS3ZCXfrUNfu:u9TpofojwjUL8IJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.bat

Path C:\Users\Admin\ExtractedUtilities1\run.bat
Size 73B
SHA256 80fb32f8dbf88b78818f619e81a9fc12e3496e2f38a2a8b3a692752c53d38c4d
MD5 8643f13e3acca9eaebf77126dbb0e5a9
SHA1 830df4340927ce390b330eb97db8c272817e1cff
SHA512 1d48ec6f9d6a3b460a1838080ea7d14088abfcc5670fd070ab4a3873301b03dccfcded97f201b26c3b45f66cfa2ea52603f966d8219234528fff91f096e6e309
MD5 SHA1 SHA512

Submit Download

utility.exe

Path C:\Users\Admin\ExtractedUtilities1\utility.exe
Size 39KB
SHA256 796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
MD5 f1b14f71252de9ac763dbfbfbfc8c2dc
SHA1 dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
SHA512 636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
SSDEEP 768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.bin

Path C:\Users\Admin\ExtractedUtilities2\data.bin
Size 385KB
SHA256 6963569bfd71c7b642826ac0cd8ac2511510168204b68a7b9940d656059f7df8
MD5 364a46c611cd7fead3527533982c616e
SHA1 3b0c8cce7a3a462d8865487f28d68c38de6851c4
SHA512 9bc71ccc5e330b2641ef57c570e49ca944d4d4de633698adf1813e1a1368c4b700d71e63598c8caa55272e4cb310aeac1eb827980a69ee03f7f7d528dddc9f7d
SSDEEP 12288:6uFh7GCuzMgjOxEJ+ThSddxs2E45TpbfNNKGIh:17xxgCcdq2EQTpbfNNtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

g2m.dll

Path C:\Users\Admin\ExtractedUtilities2\g2m.dll
Size 395KB
SHA256 dd9c9d63a5f4798d3d30ddc7d0eb569c4406b2db7224b936c0721b78b7436940
MD5 eef5e122a610edb4f13115dff624b2b9
SHA1 da324be4ee4c1573fbaedd83307ee888335d9661
SHA512 7f2318d222ac172b5aadecb09e19ff121a2648742c4e23fee91a9551a2f50014886fcb9f67f228e43fadd36fe80e71b9e6bd443b6d696533f872a2fb99862556
SSDEEP 6144:zT1N9+2qMgtcYrnWtkbGoWkYnxDrWJgVdfjJBPLbvrPtj2Ik/0:zxqzt+kYtHVRjJBb6/0
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.bat

Path C:\Users\Admin\ExtractedUtilities2\run.bat
Size 70B
SHA256 12ecd3179026dc979012895d1ba547cdd48b6940d34eb5cca266ef943c990efd
MD5 922d706a6ff52cd5f8ff57287aec9907
SHA1 c2093b630f1180bc8b48c71957655182f6a56053
SHA512 eca850162e741141a2a7e62a028cfb3c9ec45baecbdf9a0560fbc82a3aed2ef9fccd108aa8b167002fd1727e0170cdfc29a3d5d4bb574690cdeefa6b2b3e6fb3
MD5 SHA1 SHA512

Submit Download

utilities1.zip

Path C:\Users\Admin\utilities1.zip
Size 626KB
SHA256 91cb8ec6d5c15b777fac6f9960292af03feaad22b89e4df8e9fed03d8af3c651
MD5 e4c899c07a1cbaaad3e976d4ddba93ad
SHA1 27cb549500048978f671e964a150f24ec9e4c8a3
SHA512 ca76004c9957f5480575523d6c422ce8b8cbcb6e2547b09b054aed5cce862f89f96440a90e4163241557b7b2f3d07537907574325b06a0edc5036ba0e4811b59
SSDEEP 12288:9x1htVcd5SaVlIKO2CH4frDubGNYpHRp9RCTwFJa+FpMTlsTmqBvW:9BtVy3OpHYEGNWxpiTw734TlsTmqB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

utilities1.zip

Path C:\Users\Admin\utilities1.zip
Size 368KB
SHA256 0de64ba7f686c5fa5118e8544cf0935190c44c8eac3ffa3545be4a67d903b218
MD5 b9aff56013d9a86de852a6a1b82fcf9e
SHA1 6625debd422546a59b0907b88e34c997720823a4
SHA512 aea0951369259715a31f1499a7e12ffd1ae03556f4fa2158c42e85d015142366893b92a442575314ba6f762bde1c91e59ddfeb6d214c26af5a5ea6ee732daf0b
SSDEEP 6144:dUb6xJfSctVcdlDS8tVz52LKO2EjHjdqU+frDuqFFkGa0LDYKCZHo:9x1htVcd5SaVlIKO2CH4frDubGNYpo
MD5 SHA1 SHA512 SSDEEP

Submit Download

utilities1.zip

Path C:\Users\Admin\utilities1.zip
Size 526KB
SHA256 e07d39782342766acb5ae2dd5077fb1160fdf0d95fec6de817ed3b5ac6f40d23
MD5 adc96f8fef662b92868a78df1d311c44
SHA1 cfca7e537ddb9c5c29fe55efd221b50f88655b7f
SHA512 f3764175bf2f01e89ee66f9db67aa00506da47bcfe4686f6f15b8ff9a3ffc8d355544b1512525aaf5494f54fcdc635ebb517e37870507efa674c7da6bc4ad498
SSDEEP 12288:9x1htVcd5SaVlIKO2CH4frDubGNYpHRp9RCTwFJa+FpMY:9BtVy3OpHYEGNWxpiTw734Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

utilities1.zip

Path C:\Users\Admin\utilities1.zip
Size 558KB
SHA256 7831018af02ed008ad5a420392bdec8b71b2a9042e437f2802edceae48d131a3
MD5 e643597a964c30d57b473d88befc3b8c
SHA1 a18c66baeb3f2cb1f28d8a1ea131ba181c362b3e
SHA512 d8cede2138a1f56f888a44e7399d3f2ad0f0ed422143b46dac55bc647bc61afba2a7abed604bc02517d9b2fb7f6375cb223f9d63ad00a891e9479723696bf5e4
SSDEEP 12288:9x1htVcd5SaVlIKO2CH4frDubGNYpHRp9RCTwFJa+FpMTlsTm1:9BtVy3OpHYEGNWxpiTw734TlsTm1
MD5 SHA1 SHA512 SSDEEP

Submit Download

utilities2.zip

Path C:\Users\Admin\utilities2.zip
Size 446KB
SHA256 dfb1deb7f195d31ff4b2c8dfe6ff829c7ff7c4db2321c821bad79d7806b13e23
MD5 443eef47eecfdb27fe6e1e542930ec7a
SHA1 f566a1c423d2bed7d73d097e28ff8982af36a19a
SHA512 3742436af958e207f311526333ea73cef9c4b86ae4c54cfe53a22bcffe77e0c935cd3ed353f5f913c88b366c5c70c27c8f74ba27496f74fb43e72de4b74792c3
SSDEEP 12288:guFhLmC+PogjOxEX+ThSdJxs2G45TphfIwiVuZvKsCMf:TLRVgC8Jq2GQTphfIwiA1f
MD5 SHA1 SHA512 SSDEEP

Submit Download

utilities2.zip

Path C:\Users\Admin\utilities2.zip
Size 574KB
SHA256 4c9355c5648c7449c57ac3d87bc2d0518cfcacd7d34a5c008f9f9249a510a8a1
MD5 58da934b0c172e65bc1231ae9639e085
SHA1 a6ffe86523ca2a181e7ab521ac701280cc8af0a8
SHA512 1d0071026dc60cb9b364bff50879e694d4485cb8bbe80926333c4566388222c0c6b972c020ff176ee923f4bf0efaab5a6e37f8e4e2846768d6594d86a8362115
SSDEEP 12288:guFhLmC+PogjOxEX+ThSdJxs2G45TphfIwiVuZvKsCMiUQbe0qXEe:TLRVgC8Jq2GQTphfIwiA1ivb8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

utilities2.zip

Path C:\Users\Admin\utilities2.zip
Size 578KB
SHA256 c529cd95c0c85ca18df3e690f840e51d0be33b5b92f8bf1e9f91821eaedac68c
MD5 22a0424c83dfa033b6e14b05445c5bab
SHA1 eda7a7e9856373d57a664cc237f652f5711fa983
SHA512 45048d0dfda31035be9569110c396c7c78bd1017706cec913c6c217a70aefbc44db188f5bd0ffd8976ca1b49ceb54423e7a70637e5278d63b636ad66dce221c2
SSDEEP 12288:guFhLmC+PogjOxEX+ThSdJxs2G45TphfIwiVuZvKsCMiUQbe0qXEPt:TLRVgC8Jq2GQTphfIwiA1ivb8wt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1096-369-0x0000021BBEF70000-0x0000021BBEF80000-memory.dmp

Download

memory/1096-366-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/2088-424-0x0000000077620000-0x0000000077835000-memory.dmp

Download

memory/2088-421-0x00007FFF94DD0000-0x00007FFF94FC5000-memory.dmp

Download

memory/2088-419-0x0000000002550000-0x0000000002950000-memory.dmp

Download

memory/4296-471-0x0000000077620000-0x0000000077835000-memory.dmp

Download

memory/4296-467-0x0000000003C50000-0x0000000004050000-memory.dmp

Download

memory/4296-468-0x00007FFF94DD0000-0x00007FFF94FC5000-memory.dmp

Download

memory/5136-238-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5136-226-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5136-220-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5136-231-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5136-256-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5180-235-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5180-239-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5180-234-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5180-228-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5192-175-0x000001606D170000-0x000001606D180000-memory.dmp

Download

memory/5192-176-0x000001606D170000-0x000001606D180000-memory.dmp

Download

memory/5192-290-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5192-189-0x000001606D170000-0x000001606D180000-memory.dmp

Download

memory/5192-274-0x000001606D170000-0x000001606D180000-memory.dmp

Download

memory/5192-174-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5192-273-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5244-99-0x000002226A420000-0x000002226A430000-memory.dmp

Download

memory/5244-100-0x000002226A6C0000-0x000002226A6D2000-memory.dmp

Download

memory/5244-79-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5244-164-0x000002226A420000-0x000002226A430000-memory.dmp

Download

memory/5244-81-0x000002226A420000-0x000002226A430000-memory.dmp

Download

memory/5244-80-0x000002226A420000-0x000002226A430000-memory.dmp

Download

memory/5244-113-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5244-158-0x000002226A420000-0x000002226A430000-memory.dmp

Download

memory/5244-78-0x000002226A630000-0x000002226A652000-memory.dmp

Download

memory/5244-101-0x000002226A6B0000-0x000002226A6BA000-memory.dmp

Download

memory/5244-179-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5272-293-0x00000231F8940000-0x00000231F8950000-memory.dmp

Download

memory/5272-269-0x00000231F8940000-0x00000231F8950000-memory.dmp

Download

memory/5272-359-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5272-271-0x00000231F8940000-0x00000231F8950000-memory.dmp

Download

memory/5272-268-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5332-349-0x00007FFF94DD0000-0x00007FFF94FC5000-memory.dmp

Download

memory/5332-352-0x0000000077620000-0x0000000077835000-memory.dmp

Download

memory/5332-351-0x0000000003840000-0x0000000003C40000-memory.dmp

Download

memory/5332-346-0x0000000003840000-0x0000000003C40000-memory.dmp

Download

memory/5332-324-0x0000000000060000-0x00000000000C1000-memory.dmp

Download

memory/5332-347-0x0000000003840000-0x0000000003C40000-memory.dmp

Download

memory/5332-348-0x0000000003840000-0x0000000003C40000-memory.dmp

Download

memory/5492-190-0x000001DC3A670000-0x000001DC3A680000-memory.dmp

Download

memory/5492-85-0x000001DC3A670000-0x000001DC3A680000-memory.dmp

Download

memory/5492-84-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5492-97-0x000001DC3A670000-0x000001DC3A680000-memory.dmp

Download

memory/5492-96-0x000001DC3A670000-0x000001DC3A680000-memory.dmp

Download

memory/5492-177-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5492-323-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5492-178-0x000001DC3A670000-0x000001DC3A680000-memory.dmp

Download

memory/5492-191-0x000001DC3A670000-0x000001DC3A680000-memory.dmp

Download

memory/5492-222-0x000001DC3A670000-0x000001DC3A680000-memory.dmp

Download

memory/5600-416-0x0000000077620000-0x0000000077835000-memory.dmp

Download

memory/5600-412-0x0000000003900000-0x0000000003D00000-memory.dmp

Download

memory/5600-413-0x00007FFF94DD0000-0x00007FFF94FC5000-memory.dmp

Download

memory/5804-233-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5804-332-0x0000021569320000-0x0000021569330000-memory.dmp

Download

memory/5804-111-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5804-112-0x0000021569320000-0x0000021569330000-memory.dmp

Download

memory/5804-114-0x0000021569320000-0x0000021569330000-memory.dmp

Download

memory/5804-345-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5804-243-0x0000021569320000-0x0000021569330000-memory.dmp

Download

memory/5804-258-0x0000021569320000-0x0000021569330000-memory.dmp

Download

memory/5804-326-0x0000021569320000-0x0000021569330000-memory.dmp

Download

memory/5872-237-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5872-232-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5872-246-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5872-245-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5872-224-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5932-192-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5932-209-0x0000020C7BB90000-0x0000020C7BBA0000-memory.dmp

Download

memory/5932-307-0x00007FFF73360000-0x00007FFF73E21000-memory.dmp

Download

memory/5932-261-0x0000020C7BB90000-0x0000020C7BBA0000-memory.dmp

Download

memory/5932-260-0x0000020C7BB90000-0x0000020C7BBA0000-memory.dmp

Download

memory/5932-208-0x0000020C7BB90000-0x0000020C7BBA0000-memory.dmp

Download

memory/5972-357-0x00007FFF94DD0000-0x00007FFF94FC5000-memory.dmp

Download

memory/5972-355-0x00000000024B0000-0x00000000028B0000-memory.dmp

Download

memory/5972-362-0x00000000024B0000-0x00000000028B0000-memory.dmp

Download

memory/5972-360-0x00000000024B0000-0x00000000028B0000-memory.dmp

Download

memory/5972-353-0x0000000000650000-0x0000000000659000-memory.dmp

Download

memory/5972-361-0x0000000077620000-0x0000000077835000-memory.dmp

Download

memory/5972-356-0x00000000024B0000-0x00000000028B0000-memory.dmp

Download

memory/6092-157-0x0000000000500000-0x0000000000580000-memory.dmp

Download

memory/6092-161-0x0000000000500000-0x0000000000580000-memory.dmp

Download

memory/6092-162-0x0000000000500000-0x0000000000580000-memory.dmp

Download

memory/6128-184-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-163-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-183-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-264-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-187-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-276-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/6128-182-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-181-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-180-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-334-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-207-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-335-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-160-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-263-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/6128-156-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-152-0x0000000000720000-0x0000000000796000-memory.dmp

Download

memory/6128-150-0x00000000007A0000-0x0000000000820000-memory.dmp

Download

memory/6128-267-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/6128-270-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/6128-272-0x00000000007A0000-0x0000000000820000-memory.dmp

Download