d2623ed0469b4a7a8f9371cb91bad7bb803564bdda76fdcc5972905edb12f8b9

Analysis

max time kernel
138s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
holfix.exe
Size 256KB
Sample240704-xffqksvgrd
SHA256 6b3ed396381a68ca58a1f4c73f00b40e2c2f555d031690865a64f26d2c5ed7fb
MD5 53f0c95938fdb4b3f0f4814bc8b1b9cc
SHA1 08c2a4a3df5381f8f49a5ee2372728400bd24671
SHA512 2eac3782b5c1e1f45c9492b17910b60f28d2ab69aa7ec1b3e39e3ccf628fe30226c2824309a87d1b84c288b6028b903d3085d01df762ba421c7a5d5a7ddd6f9a
SSDEEP 6144:wMWnwQaTtvIa5rD1U8x7Am6OoyFoLp1kvWlp2FN6A5B5dn01:pJQatIerRUAA0o8CTlkFN6Az5dn0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery exploit upx

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\tcpip.copy	holfix.exe
File opened for modification	C:\Windows\system32\drivers\tcpipreset	holfix.exe
File created	C:\Windows\system32\drivers\tcpip.copy	holfix.exe
File created	C:\Windows\system32\drivers\tcpipreset	holfix.exe

Possible privilege escalation attempt 27 IoCs

exploit

pid	Process
4560	icacls.exe
4260	icacls.exe
4904	takeown.exe
976	takeown.exe
548	icacls.exe
5112	icacls.exe
4428	icacls.exe
2608	icacls.exe
4148	takeown.exe
5104	icacls.exe
4036	icacls.exe
836	icacls.exe
2312	icacls.exe
5020	takeown.exe
3932	icacls.exe
3360	icacls.exe
2880	takeown.exe
4592	icacls.exe
1344	icacls.exe
3548	icacls.exe
732	icacls.exe
228	takeown.exe
232	takeown.exe
2912	takeown.exe
1932	takeown.exe
3612	icacls.exe
2992	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	holfix.exe

Modifies file permissions 1 TTPs 27 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
976	takeown.exe
2608	icacls.exe
3548	icacls.exe
732	icacls.exe
2912	takeown.exe
4036	icacls.exe
4560	icacls.exe
4260	icacls.exe
836	icacls.exe
1344	icacls.exe
4904	takeown.exe
228	takeown.exe
5104	icacls.exe
4592	icacls.exe
4148	takeown.exe
3932	icacls.exe
5112	icacls.exe
5020	takeown.exe
2992	icacls.exe
548	icacls.exe
3360	icacls.exe
2312	icacls.exe
4428	icacls.exe
2880	takeown.exe
232	takeown.exe
1932	takeown.exe
3612	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral20/memory/4388-0-0x0000000000400000-0x00000000004C8000-memory.dmp	upx
behavioral20/memory/4388-124-0x0000000000400000-0x00000000004C8000-memory.dmp	upx

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File created	C:\Windows\System32\fr-fr\user32new.dll.mui	holfix.exe
File created	C:\Windows\System32\it-it\user32copy.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\ja-jp\user32new.dll.mui	holfix.exe
File created	C:\Windows\System32\uk-ua\user32new.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\de-de\user32copy.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\en-us\user32new.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\fr-fr\user32copy.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\fr-fr\user32new.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\ja-jp\user32copy.dll.mui	holfix.exe
File created	C:\Windows\System32\de-de\user32copy.dll.mui	holfix.exe
File created	C:\Windows\System32\es-es\user32new.dll.mui	holfix.exe
File created	C:\Windows\System32\ja-jp\user32new.dll.mui	holfix.exe
File created	C:\Windows\System32\it-it\user32new.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\uk-ua\user32copy.dll.mui	holfix.exe
File created	C:\Windows\System32\uk-ua\user32copy.dll.mui	holfix.exe
File created	C:\Windows\System32\de-de\user32new.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\en-us\user32copy.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\es-es\user32copy.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\it-it\user32new.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\it-it\user32copy.dll.mui	holfix.exe
File created	C:\Windows\System32\ja-jp\user32copy.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\uk-ua\user32new.dll.mui	holfix.exe
File created	C:\Windows\System32\en-us\user32copy.dll.mui	holfix.exe
File created	C:\Windows\System32\en-us\user32new.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\es-es\user32new.dll.mui	holfix.exe
File created	C:\Windows\System32\es-es\user32copy.dll.mui	holfix.exe
File opened for modification	C:\Windows\System32\de-de\user32new.dll.mui	holfix.exe
File created	C:\Windows\System32\fr-fr\user32copy.dll.mui	holfix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
4816	msedge.exe
4816	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4904	takeown.exe
Token: SeTakeOwnershipPrivilege	228	takeown.exe
Token: SeTakeOwnershipPrivilege	976	takeown.exe
Token: SeTakeOwnershipPrivilege	232	takeown.exe
Token: SeTakeOwnershipPrivilege	4148	takeown.exe
Token: SeTakeOwnershipPrivilege	5020	takeown.exe
Token: SeTakeOwnershipPrivilege	2912	takeown.exe
Token: SeTakeOwnershipPrivilege	2880	takeown.exe
Token: SeTakeOwnershipPrivilege	1932	takeown.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4804	4388	holfix.exe	85
PID 4388 wrote to memory of 4804	4388	holfix.exe	85
PID 4388 wrote to memory of 3560	4388	holfix.exe	87
PID 4388 wrote to memory of 3560	4388	holfix.exe	87
PID 4388 wrote to memory of 4800	4388	holfix.exe	89
PID 4388 wrote to memory of 4800	4388	holfix.exe	89
PID 4804 wrote to memory of 4904	4804	cmd.exe	90
PID 4804 wrote to memory of 4904	4804	cmd.exe	90
PID 4388 wrote to memory of 2444	4388	holfix.exe	91
PID 4388 wrote to memory of 2444	4388	holfix.exe	91
PID 4388 wrote to memory of 2116	4388	holfix.exe	93
PID 4388 wrote to memory of 2116	4388	holfix.exe	93
PID 4388 wrote to memory of 5032	4388	holfix.exe	96
PID 4388 wrote to memory of 5032	4388	holfix.exe	96
PID 4388 wrote to memory of 4572	4388	holfix.exe	98
PID 4388 wrote to memory of 4572	4388	holfix.exe	98
PID 4388 wrote to memory of 2212	4388	holfix.exe	100
PID 4388 wrote to memory of 2212	4388	holfix.exe	100
PID 4388 wrote to memory of 372	4388	holfix.exe	101
PID 4388 wrote to memory of 372	4388	holfix.exe	101
PID 2116 wrote to memory of 228	2116	cmd.exe	102
PID 2116 wrote to memory of 228	2116	cmd.exe	102
PID 4804 wrote to memory of 732	4804	cmd.exe	105
PID 4804 wrote to memory of 732	4804	cmd.exe	105
PID 3560 wrote to memory of 976	3560	cmd.exe	106
PID 3560 wrote to memory of 976	3560	cmd.exe	106
PID 2116 wrote to memory of 2608	2116	cmd.exe	107
PID 2116 wrote to memory of 2608	2116	cmd.exe	107
PID 4800 wrote to memory of 2880	4800	cmd.exe	108
PID 4800 wrote to memory of 2880	4800	cmd.exe	108
PID 372 wrote to memory of 232	372	cmd.exe	109
PID 372 wrote to memory of 232	372	cmd.exe	109
PID 2212 wrote to memory of 4148	2212	cmd.exe	110
PID 2212 wrote to memory of 4148	2212	cmd.exe	110
PID 4804 wrote to memory of 548	4804	cmd.exe	111
PID 4804 wrote to memory of 548	4804	cmd.exe	111
PID 4572 wrote to memory of 5020	4572	cmd.exe	112
PID 4572 wrote to memory of 5020	4572	cmd.exe	112
PID 2116 wrote to memory of 5104	2116	cmd.exe	113
PID 2116 wrote to memory of 5104	2116	cmd.exe	113
PID 5032 wrote to memory of 2912	5032	cmd.exe	114
PID 5032 wrote to memory of 2912	5032	cmd.exe	114
PID 2444 wrote to memory of 1932	2444	cmd.exe	115
PID 2444 wrote to memory of 1932	2444	cmd.exe	115
PID 372 wrote to memory of 4592	372	cmd.exe	116
PID 372 wrote to memory of 4592	372	cmd.exe	116
PID 2212 wrote to memory of 4560	2212	cmd.exe	117
PID 2212 wrote to memory of 4560	2212	cmd.exe	117
PID 3560 wrote to memory of 4036	3560	cmd.exe	118
PID 3560 wrote to memory of 4036	3560	cmd.exe	118
PID 372 wrote to memory of 3932	372	cmd.exe	119
PID 372 wrote to memory of 3932	372	cmd.exe	119
PID 2212 wrote to memory of 4260	2212	cmd.exe	120
PID 2212 wrote to memory of 4260	2212	cmd.exe	120
PID 4572 wrote to memory of 836	4572	cmd.exe	121
PID 4572 wrote to memory of 836	4572	cmd.exe	121
PID 5032 wrote to memory of 1344	5032	cmd.exe	122
PID 5032 wrote to memory of 1344	5032	cmd.exe	122
PID 2444 wrote to memory of 5112	2444	cmd.exe	123
PID 2444 wrote to memory of 5112	2444	cmd.exe	123
PID 4800 wrote to memory of 3360	4800	cmd.exe	124
PID 4800 wrote to memory of 3360	4800	cmd.exe	124
PID 3560 wrote to memory of 2312	3560	cmd.exe	125
PID 3560 wrote to memory of 2312	3560	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\holfix.exe
"C:\Users\Admin\AppData\Local\Temp\holfix.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\de-de\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\de-de\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:732
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:548
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\en-us\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\en-us\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4036
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2312
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\es-es\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\es-es\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3360
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3548
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\fr-fr\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\fr-fr\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5112
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2992
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\it-it\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\it-it\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2608
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5104
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\ja-jp\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\ja-jp\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1344
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3612
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\uk-ua\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\uk-ua\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:836
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4428
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\drivers\tcpip.sys" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /grant "Admin":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\drivers\tcpip.sys" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4560
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /grant "Admin":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4260
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\rescache" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /grant "Admin":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\rescache" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4592
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /grant "Admin":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://half-open.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8966d46f8,0x7ff8966d4708,0x7ff8966d4718
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6226567832927095331,9030527154416079195,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 b72cc6a4639e61497a979e58b24e08da89178d33e9ca0649b5eb447219c3e229
MD5 5f02d9e29249db5e6986c0c693ddc8a9
SHA1 ced2bb13e822a35c769f12906eb37c2b6dde0ce9
SHA512 dd0b044d154e1e6d8895f81f9ae6ada762357ff9f0d31a7f1d5129b90ae8e71857d53941f2006e06c7bf032dead1a5a012808240b78ff38b5fdd7bf192b16e64
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 644B
SHA256 6eb205456fb1e59cd615f46a8b8c523c3075884d7cd682d662206dcfe48fdb42
MD5 5e5fb4d487888a84dc87099298b1c37a
SHA1 1440b122ccccc9c87106b075fa3b8c172eb74d83
SHA512 36f5c446be52395acd19fd21900e14acfc77a292d6eae5e35fa220bbcb7b5ac8f60537b060c07be75d5a0cc95deeaaeee1909a3794baeeb5ec1ce9d2d952f49e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a0b3d55470c428ceee14ea428546d3b7aa73fa96370f988665dbb3c6815a27c5
MD5 29998e656c24314a7721784ef38142a8
SHA1 7bc9dda44bd0a20492a51b13a54a2e44e5d802ab
SHA512 d9f9b2617288fbcef9f644f17257155ad89e2bebfdb4863b38f0d9b2dfe3e9e667c2458ccc9b152e16f0aa31c78ab8b267c161da57624e0cac8c7448e9580861
SSDEEP 96:nXkVA41yAeEcwpvWMoiVmdeHnad36UWQyV+VDCziEwb:nXk7kAebGWMX46ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fdb1a00cfbc8d6901fcc6d01b54d074515c7ab84c46df72bc99c2127b84c0f7d
MD5 1884df1ef83ae5a8b1147f09a5c997de
SHA1 09af013ae392b4076173b7ef5c60dd5f6c0ade71
SHA512 0c5023be1514faa5e3f20f63bc12c0319c99af879cfc920311f99bdb54d886d882e11aee63c9240db1135401f5b0abcfdda286b7f09b647f4a343690b3da12f5
SSDEEP 96:nXkV741SAeEcwpvWMoiVmdeHnad36UWQyV+VD7AiEwb:nXkWgAebGWMX46rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 573c783c5d634df8495f45d99fbf8715e3818dcd0556ec93c0ba488687a70ac7
MD5 8078602897e7215b8e243fa8bb00872b
SHA1 eadee11036d0d930948a3ab582972d6b5021b409
SHA512 956d2947534503858c8b3b517843961b3f843d3a43f56b6637c4f9f6275a1f0f21085d71e902dab2689da1ec1533b8c0da3a4cccf79591560c0d3f7a03119ada
SSDEEP 96:nXkVX41SweEcwpvWMoiVmdejuA1IXV92nVd36UWQyV+VD7AiEwb:nXk2gwebGWMzuACXV92T6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ff7e8c8709e88fd81ddabd2059a3feac0c5eec881982110e80bd60198e9c5cc2
MD5 20902e232f6d0f2f0dc71716feb848d9
SHA1 1bb76b6dee4e83e31656aca9d05f180c08d842a2
SHA512 60d1aee452d790adfe1e85b6dbe32a8e74352ee63acf2b08540f56bb07ad9c97521f1419ecf1f7d41ffd5700cc60a46ebec92f05c0e2ee63bbf92f898f339be4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptSae2RULUtdyuSB6VD7PYK:A9iIxuERzA83h09RZxYM05dyukK
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\de-DE\user32new.dll.mui
Size 19KB
SHA256 bd2c70e7e8720942b4bc3020929b894bfbe5e9d97082a821272b73f5d480e9b3
MD5 f8d6dd4349b7f240c6cd4d04d21657f7
SHA1 744e7220be770ddce55fc6242fa3c5547725fcd7
SHA512 96f3e427b735a63b49c07e7f14754b996324a58cc15cf99e55c1ba1555dfdbeb7734719b06d4a95c322b3a9bb31c0bb192d78b06981c03ba0678538dd4890f4f
SSDEEP 192:9ujv55W5RdAtugoiZVziM1GBDXies7Y3Wl+Cb:g15sRdAtuviZliMOziFYWl+a
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\en-US\user32new.dll.mui
Size 17KB
SHA256 6921a8d82bd3586df770d2854dc9c538f6de996a64c63c29e31b1e84be040f4a
MD5 90b43ec7eb2e379561b0efd0d93342bb
SHA1 efdc5321144229a02e2347ae71ef1e9a869d8d3c
SHA512 5cc5f9045c90e8fd7d0ddbc242ef64df71b10e36c3a6e5d25db8dbc2608aa3ec48b2a6b71686fa4646e40eefec700e0b2c324e8bde7da9239be98f1416a58e4e
SSDEEP 192:onnn9hDQLrbyxrfrJm/Nkeeu9DI3iqscomAnGhWgbWI:onbsbEf9m/+ea3pzomAnGhWgbWI
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\es-ES\user32new.dll.mui
Size 18KB
SHA256 a0fc551bc1fe60ecedc79c387a3311f9879d1f69509e61c6a6e472534d7b4448
MD5 88e058f2f65a9ecfc4023f5d6512bfee
SHA1 c3a86890e1560d33309c0e019d573855028a811b
SHA512 e51ac8a044bd5a0de3eb5128efccaa04ee54c5578c698b00bef3ffd9094e51e550b757916af4e7992407019614fd816dd9d78231b6821813bf3e9b4e217f807d
SSDEEP 192:4ZAEBAkOfCJ1Bfmib1W+BBkHg7R3GVoiCE3aZQM3K3NmW07B:4Z7gfCRBCHg7R3GVoiCE3a6M3aNmW0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\fr-FR\user32new.dll.mui
Size 19KB
SHA256 39519ade42cac753b5fd8586786e292ada3c4910041353b31730fa3079801c21
MD5 3996e9a5f0cc85e93aa7ade49a892c5e
SHA1 fa2b4d88bc4b2efb7acd13a83003ec23c44c2664
SHA512 99a84f565c0c730472ebb7940c260460f54b1c88c446c3869ce5e889f4fd14230b40c6267de751d93a3e1882d6ac6cd29a6026591aebb3600caa7b508bd5d414
SSDEEP 384:htYgO4DdWtegWTb1ekI+6DHZToljHpaWA0e:hyfSYWZPda9
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\it-IT\user32new.dll.mui
Size 18KB
SHA256 da174e40ddc8260b809f6331a2d3aa37daa108acd09aef38048432bd1ca283f7
MD5 c99c413b13017aa89431469764aab8cd
SHA1 a556fc89f96414c3d2b262841b207065a5e205c9
SHA512 da93ae0f081900c612c66967c27baf19b2d2054462971887d295b3db3ca5c1e5dbfd92bd258c4acc683b7ea3414466ded4d6ae85464a4eca7e08029fb4c1d615
SSDEEP 192:wXzDoRflpAhQrh0JcB0NSf6ZydcQMYedAKvZp73Hvj3ExVW57c:wXXoRfE4kSMW9KvZp73Hvj3CVW5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\ja-jp\user32new.dll.mui
Size 13KB
SHA256 9c8c73bd07a703b1561e611e8e0754e3070aca9780069016061986550c3da772
MD5 e69bdd36a3eb328b1af034c72f160495
SHA1 7615ada4ae284c46dd7ae5212e336aef597814ca
SHA512 f6fb9b3936b856548d2a728506898556048e0708be7803b50a12063db39943f9ebb5013a8f670e3e1c2ce1f4865b7cc6470c3b87bc01957b8749305cc4cc2ec8
SSDEEP 192:4jQLB2Y6+A3fJBC79td8HM4mcLbN3HzEkWlbWd:4UP6+A3B879td873HzEkWlbWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\uk-UA\user32new.dll.mui
Size 18KB
SHA256 4d8dadf1c2659434290a2e304f9e87a1bd7de443ec8c7599d44d6f9e1636e77e
MD5 aa12a3301c30a46acd35972b04c0a71f
SHA1 56a6a8b5f74e1bddb382f70e8fafa84d2313e364
SHA512 cd64db81fcc2129b73c864bc63f987b447b7c1cea3194bd48f9aa34fb905617e72c585885f3dc071063a08b760bb75ef57f0ae2bca261435c567b4ce8e6f80c3
SSDEEP 384:db1wUgAoo4raY83QZr4/Bw/T0pNUnM+lyTp9W0Ki:kDGUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4388-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/4388-124-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/4388-1-0x0000000000690000-0x0000000000691000-memory.dmp

Download