blackguard | 202faa66219e927a3b57d90ee9b2b4fbd309ed72ff89a7e28d7668ca08d0fd49

Resubmissions

22-05-2024 07:50

240522-jpeb8agg24 10

22-05-2024 07:46

240522-jlztragf56 10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Valkyria.exe
Size

8.2MB
MD5

1626922cadeeedea404cadfe628d7e16
SHA1

9323dbefdd49c84ae79e188b79bac5cee2ab6a6e
SHA256

202faa66219e927a3b57d90ee9b2b4fbd309ed72ff89a7e28d7668ca08d0fd49
SHA512

80d0d6b93a8b85e2ed0fb6dee775b6f40f6d39381640c8e8ab3309f58e84d8b17e86b321849a2ffdfa4b7dd39736730b5a1d822f95a20153c1d41d52b604a9e0
SSDEEP

196608:68oppJhh2fJB0ZOFkGEWZd7HFApko0eYOiKddHB2icEPld6aGXAr5xN:6jppJEJB0ZOFNVZRlekSFPvHlQAxN

Score

10^/10

blackguard njrat evasion spyware stealer trojan

Malware Config

Extracted

Family

blackguard

https://api.telegram.org/bot5865379362:AAEUbyvhTdYJ7SmCp7YyfRe8OBV_Jrj9iqg/sendMessage?chat_id=5481385928

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4244 netsh.exe

pid	process
4244	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Valkyria.exeEverything.exezkzkzkz.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Valkyria.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	zkzkzkz.exe

Drops startup file 4 IoCs

Processes:

server.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek HD Audio Universal Service.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\07fe81bb92603a7ba50e57049dc09693Realtek Semiconductor.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\07fe81bb92603a7ba50e57049dc09693Realtek Semiconductor.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek HD Audio Universal Service.exe	server.exe

Executes dropped EXE 4 IoCs

Processes:

zkzkzkz.exeEverything.exeNatasha.exeserver.exe

pid process

452 zkzkzkz.exe
3464 Everything.exe
1224 Natasha.exe
3200 server.exe
Loads dropped DLL 5 IoCs

Processes:

Natasha.exe

pid process

1224 Natasha.exe
1224 Natasha.exe
1224 Natasha.exe
1224 Natasha.exe
1224 Natasha.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
9 freegeoip.app
21 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
452	zkzkzkz.exe
3464	Everything.exe
1224	Natasha.exe
3200	server.exe

pid	process
1224	Natasha.exe
1224	Natasha.exe
1224	Natasha.exe
1224	Natasha.exe
1224	Natasha.exe

flow	ioc
8	freegeoip.app
9	freegeoip.app
21	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Natasha.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Natasha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Natasha.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Natasha.exemsedge.exemsedge.exe

pid process

1224 Natasha.exe
1224 Natasha.exe
1224 Natasha.exe
1224 Natasha.exe
4516 msedge.exe
4516 msedge.exe
4884 msedge.exe
4884 msedge.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

server.exe

pid process

3200 server.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

4884 msedge.exe
4884 msedge.exe
4884 msedge.exe
4884 msedge.exe

pid	process
1224	Natasha.exe
1224	Natasha.exe
1224	Natasha.exe
1224	Natasha.exe
4516	msedge.exe
4516	msedge.exe
4884	msedge.exe
4884	msedge.exe

pid	process
3200	server.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

Natasha.exeserver.exe

description	pid	process
Token: SeDebugPrivilege	1224	Natasha.exe
Token: SeDebugPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe
Token: 33	3200	server.exe
Token: SeIncBasePriorityPrivilege	3200	server.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Valkyria.exeEverything.exezkzkzkz.exeserver.exemsedge.exe

description	pid	process	target process
PID 932 wrote to memory of 452	932	Valkyria.exe	zkzkzkz.exe
PID 932 wrote to memory of 452	932	Valkyria.exe	zkzkzkz.exe
PID 932 wrote to memory of 452	932	Valkyria.exe	zkzkzkz.exe
PID 932 wrote to memory of 3464	932	Valkyria.exe	Everything.exe
PID 932 wrote to memory of 3464	932	Valkyria.exe	Everything.exe
PID 932 wrote to memory of 3464	932	Valkyria.exe	Everything.exe
PID 3464 wrote to memory of 1224	3464	Everything.exe	Natasha.exe
PID 3464 wrote to memory of 1224	3464	Everything.exe	Natasha.exe
PID 3464 wrote to memory of 1224	3464	Everything.exe	Natasha.exe
PID 452 wrote to memory of 3200	452	zkzkzkz.exe	server.exe
PID 452 wrote to memory of 3200	452	zkzkzkz.exe	server.exe
PID 452 wrote to memory of 3200	452	zkzkzkz.exe	server.exe
PID 3200 wrote to memory of 4244	3200	server.exe	netsh.exe
PID 3200 wrote to memory of 4244	3200	server.exe	netsh.exe
PID 3200 wrote to memory of 4244	3200	server.exe	netsh.exe
PID 4884 wrote to memory of 3976	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3976	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 3664	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 4516	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 4516	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 4944	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 4944	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 4944	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 4944	4884	msedge.exe	msedge.exe
PID 4884 wrote to memory of 4944	4884	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Valkyria.exe
"C:\Users\Admin\AppData\Local\Temp\Valkyria.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\zkzkzkz.exe
  "C:\Users\Admin\AppData\Local\Temp\zkzkzkz.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:4244
- C:\Users\Admin\AppData\Local\Temp\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\Everything.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Natasha.exe
    "C:\Users\Admin\AppData\Local\Temp\Natasha.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe40a46f8,0x7fffe40a4708,0x7fffe40a4718
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4f168dfc66b47b1746adb82e92f90f7

SHA1
dcf48616b60e50b9249ec42e4a2c5952d701c4a4

SHA256
e8009b86238486d8cb4b8fbdd562efa6ecdeef8366120dd314069c2ea445ab28

SHA512
7e5c47da3ae7a1fb1743265d4ea50c6a922923e7e14cb70f26826f33800282e4fd91f6476fdb665895114f18fcdece478163519809cee1cf848f11a9d6964b8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Everything.exe

Filesize
7.7MB

MD5
37f6f35584fac7f216e69e813d4b7c10

SHA1
ddb093f14e5f2beb0512ac828448ff06d0237312

SHA256
cc17414b5bd2db809411f93256535e78d0c97f42fe86b6cc3119aa7c33c6e3c3

SHA512
917368e662428827f8477cc5915e41f6a06324f0e49721f807a6003740749261a219a25cd3d9a43d1a5714c73930e4b2da1240d2a9f108a62b11f990dc42a09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Natasha.exe

Filesize
270KB

MD5
0ad61d702d2aca6801a833ec1d4bf5f7

SHA1
d4117c6c5c0ae71ee0ccd2554ab40fe69796c519

SHA256
e4668273e4cafe5a9a083eaa0d4d52ca1ba707e37ecb715c1b97de1dbb67faf4

SHA512
a0743430cabc74edb8600c71a4513ab83d21542a8088d230cd15e070d6b2b2d70dab057dd1bbd1968836bc0f3b3aceb90b98024b889503c6a28926475185e6ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll

Filesize
571KB

MD5
169b6d383b7c650ab3ae2129397a6cf3

SHA1
fcaef7defb04301fd55fb1421bb15ef96d7040d6

SHA256
b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf

SHA512
7a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.3MB

MD5
0a1e95b0b1535203a1b8479dff2c03ff

SHA1
20c4b4406e8a3b1b35ca739ed59aa07ba867043d

SHA256
788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e

SHA512
854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

Filesize
410KB

MD5
056d3fcaf3b1d32ff25f513621e2a372

SHA1
851740bca46bab71d0b1d47e47f3eb8358cbee03

SHA256
66b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9

SHA512
ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180

Download Submit
C:\Users\Admin\AppData\Local\Temp\zkzkzkz.exe

Filesize
93KB

MD5
ac79af1c488ed1bc1b289e0eb8d89714

SHA1
913ceaaaf7664bb83a496ebe746b6d12bb1e5e9a

SHA256
dc8e217ced1f36323ce6c237fdaa330e342063a819c13defe3b248ee84c1d492

SHA512
cd09c7c5e60ba946f7c83001876f3d5c48eab06c259324a7941161978531a175d00142cd486ff7cf0d2d461a651745808361e894346259ac079cc90eb42022cc

Download Submit
C:\Users\Admin\AppData\Roaming\NZDRBVDBBwVVTwPXNDFZBXDXUA.Admin\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\NZDRBVDBBwVVTwPXNDFZBXDXUA.Admin\Process.txt

Filesize
1KB

MD5
16eb2215358957213d4d8298d02102d1

SHA1
ba0ecbb3a189c19593b073b807570bac6535427b

SHA256
c61782b3ff13512c143add7c479a7ea12417b6254790a85b75664eff26f41614

SHA512
c0410a43e7908c425a82206c21bb403701aca85bfff7918bdcfa5cad03cc67a7c9e8e3f2b096bac505e5081c47a9006a63b90ed42a2760d178081c07551e1546

Download Submit
C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
d43c5b07c128b116b7bc8faf7b8efa9d

SHA1
dd3540ad4ae14b21b665d108cf4570c2dfa6a6fa

SHA256
80ad1cc7b3a784dad618a445af0c8cf3efa903f82a814756f2aaa7b57f45791f

SHA512
618b01e2b808e1954d011635dfdf63bc75855145208fc5cae33ce09c7e5b43cf978f6511beb311765e6920e728a290c9f9ced7563e40e8ff8d093d50fdc18334

Download Submit
\??\pipe\LOCAL\crashpad_4884_KCXJMZYJRVDKVQOP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/452-14-0x0000000073FD0000-0x0000000074581000-memory.dmp

Filesize
5.7MB

Download
memory/452-11-0x0000000073FD2000-0x0000000073FD3000-memory.dmp

Filesize
4KB

Download
memory/452-133-0x0000000073FD0000-0x0000000074581000-memory.dmp

Filesize
5.7MB

Download
memory/932-18-0x0000000000400000-0x0000000000C30000-memory.dmp

Filesize
8.2MB

Download
memory/1224-61-0x00000000061F0000-0x0000000006282000-memory.dmp

Filesize
584KB

Download
memory/1224-103-0x0000000005C10000-0x0000000005C32000-memory.dmp

Filesize
136KB

Download
memory/1224-115-0x0000000006A50000-0x0000000006A71000-memory.dmp

Filesize
132KB

Download
memory/1224-114-0x00000000070F0000-0x000000000712C000-memory.dmp

Filesize
240KB

Download
memory/1224-120-0x0000000007FE0000-0x00000000081A2000-memory.dmp

Filesize
1.8MB

Download
memory/1224-108-0x0000000006BF0000-0x0000000006F44000-memory.dmp

Filesize
3.3MB

Download
memory/1224-109-0x0000000006F50000-0x0000000006F9C000-memory.dmp

Filesize
304KB

Download
memory/1224-136-0x0000000008760000-0x0000000008D04000-memory.dmp

Filesize
5.6MB

Download
memory/1224-107-0x0000000006A80000-0x0000000006AE8000-memory.dmp

Filesize
416KB

Download
memory/1224-224-0x00000000090A0000-0x0000000009106000-memory.dmp

Filesize
408KB

Download
memory/1224-227-0x0000000009110000-0x0000000009186000-memory.dmp

Filesize
472KB

Download
memory/1224-228-0x0000000007F60000-0x0000000007F7E000-memory.dmp

Filesize
120KB

Download
memory/1224-102-0x0000000005C60000-0x0000000005CB0000-memory.dmp

Filesize
320KB

Download
memory/1224-101-0x0000000005E10000-0x0000000005EA2000-memory.dmp

Filesize
584KB

Download
memory/1224-50-0x0000000000EE0000-0x0000000000F2A000-memory.dmp

Filesize
296KB

Download