hxxps://archive[.]org/details/malware-pack-2

Resubmissions

06/07/2024, 19:34

240706-yaglcs1emn 10

06/07/2024, 19:29

240706-x7jasa1drl 10

06/07/2024, 19:22

240706-x29wjs1dmq 8

Analysis

max time kernel
230s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20240704-de
resource tags

arch:x64arch:x86image:win10v2004-20240704-delocale:de-deos:windows10-2004-x64systemwindows
submitted
06/07/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://archive.org/details/malware-pack-2

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Loads dropped DLL 64 IoCs

pid	Process
1420	[email protected]
1420	[email protected]
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2100	MsiExec.exe
2776	MsiExec.exe
2100	MsiExec.exe
1420	[email protected]
2100	MsiExec.exe
4192	[email protected]
4192	[email protected]
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4936	MsiExec.exe
4024	MsiExec.exe
4936	MsiExec.exe
4192	[email protected]
4936	MsiExec.exe
3636	[email protected]
3636	[email protected]
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
5040	MsiExec.exe
2444	MsiExec.exe
3636	[email protected]
2444	MsiExec.exe
2752	[email protected]
2752	[email protected]
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
2940	MsiExec.exe
1100	MsiExec.exe
2940	MsiExec.exe
2752	[email protected]
2940	MsiExec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
57	2100	MsiExec.exe
59	4936	MsiExec.exe
64	2444	MsiExec.exe
66	2940	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB72E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B62.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE0C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5997df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5997d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA8F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5997df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DA9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F02.tmp	msiexec.exe
File created	C:\Windows\Installer\e5997d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE9A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0EC.tmp	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File created	C:\Windows\Installer\e5997da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID316.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB79C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C7E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID874.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDBB6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID470.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC24.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAFD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID384.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Installer\MSID942.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB946.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5997d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A85.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8B3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB630.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI985E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID912.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC92.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB839.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID208.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID815.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID13B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI9C1F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5997da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB68E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI991A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D0B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB859.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSID2B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID000.tmp	msiexec.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1052	1208	WerFault.exe	122
2460	1732	WerFault.exe	144

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "20"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
500	msedge.exe
500	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe
4264	msiexec.exe
4264	msiexec.exe
4264	msiexec.exe
4264	msiexec.exe
4264	msiexec.exe
4264	msiexec.exe
3636	[email protected]
3636	[email protected]
4264	msiexec.exe
4264	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4264	msiexec.exe
Token: SeCreateTokenPrivilege	1420	[email protected]
Token: SeAssignPrimaryTokenPrivilege	1420	[email protected]
Token: SeLockMemoryPrivilege	1420	[email protected]
Token: SeIncreaseQuotaPrivilege	1420	[email protected]
Token: SeMachineAccountPrivilege	1420	[email protected]
Token: SeTcbPrivilege	1420	[email protected]
Token: SeSecurityPrivilege	1420	[email protected]
Token: SeTakeOwnershipPrivilege	1420	[email protected]
Token: SeLoadDriverPrivilege	1420	[email protected]
Token: SeSystemProfilePrivilege	1420	[email protected]
Token: SeSystemtimePrivilege	1420	[email protected]
Token: SeProfSingleProcessPrivilege	1420	[email protected]
Token: SeIncBasePriorityPrivilege	1420	[email protected]
Token: SeCreatePagefilePrivilege	1420	[email protected]
Token: SeCreatePermanentPrivilege	1420	[email protected]
Token: SeBackupPrivilege	1420	[email protected]
Token: SeRestorePrivilege	1420	[email protected]
Token: SeShutdownPrivilege	1420	[email protected]
Token: SeDebugPrivilege	1420	[email protected]
Token: SeAuditPrivilege	1420	[email protected]
Token: SeSystemEnvironmentPrivilege	1420	[email protected]
Token: SeChangeNotifyPrivilege	1420	[email protected]
Token: SeRemoteShutdownPrivilege	1420	[email protected]
Token: SeUndockPrivilege	1420	[email protected]
Token: SeSyncAgentPrivilege	1420	[email protected]
Token: SeEnableDelegationPrivilege	1420	[email protected]
Token: SeManageVolumePrivilege	1420	[email protected]
Token: SeImpersonatePrivilege	1420	[email protected]
Token: SeCreateGlobalPrivilege	1420	[email protected]
Token: SeShutdownPrivilege	4668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4668	msiexec.exe
Token: SeCreateTokenPrivilege	4668	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4668	msiexec.exe
Token: SeLockMemoryPrivilege	4668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4668	msiexec.exe
Token: SeMachineAccountPrivilege	4668	msiexec.exe
Token: SeTcbPrivilege	4668	msiexec.exe
Token: SeSecurityPrivilege	4668	msiexec.exe
Token: SeTakeOwnershipPrivilege	4668	msiexec.exe
Token: SeLoadDriverPrivilege	4668	msiexec.exe
Token: SeSystemProfilePrivilege	4668	msiexec.exe
Token: SeSystemtimePrivilege	4668	msiexec.exe
Token: SeProfSingleProcessPrivilege	4668	msiexec.exe
Token: SeIncBasePriorityPrivilege	4668	msiexec.exe
Token: SeCreatePagefilePrivilege	4668	msiexec.exe
Token: SeCreatePermanentPrivilege	4668	msiexec.exe
Token: SeBackupPrivilege	4668	msiexec.exe
Token: SeRestorePrivilege	4668	msiexec.exe
Token: SeShutdownPrivilege	4668	msiexec.exe
Token: SeDebugPrivilege	4668	msiexec.exe
Token: SeAuditPrivilege	4668	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4668	msiexec.exe
Token: SeChangeNotifyPrivilege	4668	msiexec.exe
Token: SeRemoteShutdownPrivilege	4668	msiexec.exe
Token: SeUndockPrivilege	4668	msiexec.exe
Token: SeSyncAgentPrivilege	4668	msiexec.exe
Token: SeEnableDelegationPrivilege	4668	msiexec.exe
Token: SeManageVolumePrivilege	4668	msiexec.exe
Token: SeImpersonatePrivilege	4668	msiexec.exe
Token: SeCreateGlobalPrivilege	4668	msiexec.exe
Token: SeRestorePrivilege	4264	msiexec.exe
Token: SeTakeOwnershipPrivilege	4264	msiexec.exe
Token: SeRestorePrivilege	4264	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 4860	500	msedge.exe	83
PID 500 wrote to memory of 4860	500	msedge.exe	83
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 1636	500	msedge.exe	84
PID 500 wrote to memory of 4236	500	msedge.exe	85
PID 500 wrote to memory of 4236	500	msedge.exe	85
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86
PID 500 wrote to memory of 3940	500	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://archive.org/details/malware-pack-2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6a2d46f8,0x7ffd6a2d4708,0x7ffd6a2d4718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --service-sandbox-type=collections --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,667836150339422557,1281488104847745996,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2072

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1420
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 30F0DD2325BC6508A879E6BABB955861
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  PID:2100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 98C0940EF064B10DA990942B18C07F9D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BA62EBA71CA7B7C502B40820BB8D3D32
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  PID:4936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0EF2A694B87ED8307758A1B6F2C3C5F2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:4024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2F0546DDC496A55F2BEA9EFC18D1F48F
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  PID:2444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9DAA24E97C940E1F4D33B3E282B1D5DD E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:5040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CD5BC0E6F1E8DE2F8EAB4C658766803
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  PID:2940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5347C27E886B3B1A4EA802CD04C16405 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1100

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:4192
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  PID:4808

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1580
  2⤵
  - Program crash
  PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1208 -ip 1208
1⤵
PID:2436

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:3636
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  PID:2068

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]"
1⤵
PID:1772

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:2752
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  PID:2408

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
PID:1732
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:4348
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 2724
  2⤵
  - Program crash
  PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1732 -ip 1732
1⤵
PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResizeLimit.bat" "
1⤵
PID:3388

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3910055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5997d4.rbs

Filesize
100KB

MD5
ee21fdded4b8576023a93db945dc7f11

SHA1
7c624f9ecde0157f33a1b7668627948cbd052502

SHA256
5417a20f51764af6be9b5307f33b35b6a09901bcac186bb346d5aa39b3ceea5c

SHA512
b26fd9d89f7d943d302349816bccd8513cba9b4329f4e54cee51d3ee30ae94c8b80861d9b2847c28f2b0e0437a570edc6be0354055b3928009dd11b2c30c8fb4

Download Submit
C:\Config.Msi\e5997d8.rbs

Filesize
101KB

MD5
3e1f422f55bf220490c13b2961058c94

SHA1
dcc971a902f883d525d164f7f7ce4e78c09ad6c7

SHA256
00808f033677e2dab2271083d57669cb4b92b263879b72c1dde95b6f4083a7c4

SHA512
4d31bfeac85de27b4101a6c7fcc5dfce2d7a9eb65ad008a2fdca1f25a224de8d26084524f7e68f2819c5b12b9a839eb504a27598457294afbe4986675a1ebc41

Download Submit
C:\Config.Msi\e5997dd.rbs

Filesize
101KB

MD5
944a8843ebb427f4af55219c667c60fa

SHA1
1190950833dc8f03113f46c13785fa94bd782c62

SHA256
b7f9ccac5cc8e5c8eb99c99986602d2b057f1629ae0efdd96da9d509dd152545

SHA512
af5128719f87adce60af198bd3e4b07ab98efbcd24f20817d4ce56eb8a526ce007f446178cc62aae70e46c6925af19b0453524a094a713189395e718da69671c

Download Submit
C:\Config.Msi\e5997e2.rbs

Filesize
101KB

MD5
ecc57fda715669c89d5e9d3a7e817240

SHA1
3da90f37049f0a057a0ff91c84653d34516bb251

SHA256
4df29be01475b312fbc1dbc06af038c6ba5082d49fdf0ffac5679aa38a0928f0

SHA512
ccb5a7270d3a082380bd06b33b878768cdcab661a004614d014bf2af9263409550c2822701d4e765ca75b595279aec0f04f7f1ac30c4e708cfba1d117cb5084e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f0f818d52a59eb6cf9c4dd2a1c844df9

SHA1
26afc4b28c0287274624690bd5bd4786cfe11d16

SHA256
58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

SHA512
7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0331fa75ac7846bafcf885ea76d47447

SHA1
5a141ffda430e091153fefc4aa36317422ba28ae

SHA256
64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

SHA512
f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
65694bda00037409007c9cf9d7ee1a61

SHA1
b6771728545ff115dfb77f4e828478a1f236aee8

SHA256
fa8f28a3c540334f1ceac217513e20ae0e9a85941fa9d2b84038ffa9465c7583

SHA512
4986acf4e62e36de656a938d9638b5fd285d241644df0f2234440b1bdc5dd55d971e8acbed31e6f6372af65acccced0e4141d9c290cb4d22de87db9a37d73017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
417B

MD5
9569c6c5ca4f92e7791c2870e46d424f

SHA1
59dfaa43b744cf41b074491f4dc095d7d3b0cd5f

SHA256
dcdd6bc4c16d3903124c2f6bcefc87f805df87516d045e0039991fb026516857

SHA512
ba039b6e52d3efc19876c8f3aab6d5c6b155e1115dbd71eeae74ff23092fe6346bfcd354fc5dba0c3ea766f206da69e255a5d980ee1a7fcb2539ab76a3674e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
340f42a80ac6e8b0099cf05984e5e5a5

SHA1
fa14f86df8960b55fd6a91f79d83ebdeca1f0356

SHA256
115cc619093a0d086bc6666563fd750d7e793cf2a7b6b93fabf1d739d5507cbf

SHA512
fa1c2557ef57a2fc07b34ce9ed003f92f8f161edba24a055383ee91a5fbbac0a904074ef06f0b318253505d9efc1ed5d79d1b96bd46aa9063263ec862d7c3ad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf71821e24485e3b4901599d463044e2

SHA1
b1d56a0bc8ae697ed9f0745c6a61d7885ecd17b1

SHA256
f1a94809510e18d8f93972b4ce31e40ed5f35d64a8be8bd30a526b87a8f0a094

SHA512
4cbcd5768eb0089c2fa721fdd2fbbf2641268043e508f496a01a9e6db999159646188541e6d0aa21e4635c874b25ce241392ff0cad3d9e8eb4767b8b76ec9f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d95f343ed60a6e2edad653d7ab872dae

SHA1
7d9cba931f15542f5e9e0edbc64a084125325b79

SHA256
aea266ce36fe299cd104652ee9f3a3bbc8226382f2a89a770578f668adc0121e

SHA512
85a34e365e1bfb8a02216e0e2a77e2289757c3b681a22a2b2e42af37e6655e5735cefcaf9d8812cbef716b46801113da6f2eebe4d8bc096a66bd4ac419a2d2f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d428e9236c4bbc021a4af906a447be2

SHA1
b0fe7d915d0f3a240e8ef3201dfe74cde12dfd56

SHA256
d948aadc53123ea33b48cb7c5482b6bbc16da1a00c3ff0f4e868cc21234815bc

SHA512
73fa37782e5f96e0110a3e0ce34280d49650b9492eaca65eedc73ee3ec71d5b6b15c2ea09b3eec61c9b2ce2cdeb8f908a1160cb578bb64acc121a55c25d16383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
08e7f28ca3a340c5870962a6e08e95eb

SHA1
b09f01074772d17f31985d1831dc3f51e0fee0be

SHA256
de90571a4d6f9a27414ad9d1c9cc9c9a381bebc3d174a273da098a69047261fc

SHA512
7f823b36141c046a2a9baede0b46795baf36680c82bce6ba507f4fc8736fddc7e937677bd5e71730eb5887ffb83a315fe6e5868cc79e0889ce1cf9701b4053f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581bb1.TMP

Filesize
372B

MD5
2d2b5a13529177c81b23d619cb625f4e

SHA1
9220151ceaec88a2ff2e8d851059db706a97c241

SHA256
86a525141757cb7a7d1e599435546ea56a2047bc7031f54abe7687c787d1af50

SHA512
8b42af1f7fe9d819d56c0da88258ac05e85ad79b998c2094c7a4e37cd669b02ae582214a31ac12091a154a8c8d079d95cbea09caf531c33c969c856facac1ac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50cec79e79231fceceb9ff6f87acba51

SHA1
13bca85e57ab64341b090768a458843d27070c8d

SHA256
1a6723382e7abd9f6bf1eb2f06be115cded193667ed0280758b890fbea4d4966

SHA512
54924b83782ed200e533479b993006384f41656c0581490a97d971626ed7eaefbc21a519bcb8abc4a8acb4ff2b17191633a5640fe7f48c8412ea0c3a0d20f528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
55ea13cd8543329c1a2daddb3ef156e9

SHA1
29bed264f915f221290d6ebe21cfe8440190fab5

SHA256
d1b473697a47b82f99993c02fbca5a66eb328a343ea80e62d2416e023d9bb2e9

SHA512
faec63137eb70f9a2f802deed6fca8a60dece55b5059b17364d11f2f4b44b620f4d15715e94282063cc4ca364192c35997c9748fb7377488d85603ceeed33a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9822b67f971dc54574165e274ae3808f

SHA1
e218bb7d5ef56186d7da19e42dc0604dfba7f363

SHA256
a55f8df6a0623bf5fd3848a837c5f63ae81c52bf55bf0172d71c77b4fe54ca1e

SHA512
b22443c4f87f8a1079008a8488e3513d904241aba6990afe6b8823022c102c740764d9ec848745c4595552fee9de943381b396b5a25c70021c5b5664fa5f1bc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
6e57d53e8483420851241496ae482b7b

SHA1
3e27e96d68855ff7dcdb7b7b2cd71979bb08c78a

SHA256
f082e9b0d764c792c4377e400158634fe4504b3433ecfeefbea709e0b38cdf45

SHA512
7495db70fdaf307a597c16cd90981290aceabd8a0ed5401b35efd8d344a18d3792588db1b5f82918a60c6903b1c24bfa68b8259113a508a36b78cd99f721fd50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
d253c68f2a26415a00c1cab791e78dfc

SHA1
123d8b4cad9730e53bd0d24fb2bbfa580fcb3820

SHA256
987d9cfa3c5982ac5423b4db96c61283f3f9e539cf116174c873f4ecab97986b

SHA512
1742f619308bad816dae2644f59773b390b5c7f6a22976dc6f4cc380a515f2598b187137fce191d9a9429939723f088eff9f6f6e9b759ec694f81e17296e5c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
1b0065eceebcbe7fa901d074b75b57e4

SHA1
848026167c26baca270373e871b2724f307af89d

SHA256
78a478054d40343f97498241d875af6d93f02061fe67784ff76f455ecb00123c

SHA512
f9aefdaa4d700d56db487131ba3cbd725254873c5153193c04f44837220242438ec7dfbf7989196d78549a1c66a7455a1623c4f2a3704f6e7b4aa79a47e83ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
c465bf950a8fd38ec84bde76286b2d4e

SHA1
9a15d6096d28ed4310747681223666b169ae5ea6

SHA256
9ef4ebb23eb266f3e475ba02d3b1632a8bf24853c3702b6e4e174e3ccccac41a

SHA512
68917089dbca563924323c13541477a073adcda564430edc71888323500401abb7457412986aa1f3142b8576b80dd1e17ca7d194ee3fde837f022320be516a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
42353c624efddd8d22758118ab7c6d01

SHA1
83a43f1d52c16b13b347192926aeee0961419230

SHA256
c49cc6e795970dff3c343b835de37a67edc0d52769b31dc0ac890626678672a3

SHA512
e3cb1e19e9eca048e711dc14805be7bb5d796c3a03c99a65d1fa3d25c52ba15b3cc31fad482a452bec7c336da25c1c7142a4f5e818027db8f8280e44acbc2c8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
21bd0f400c929805b156fca6e478c678

SHA1
06652d0b548ed3266736f3a670c34e7dac917cdb

SHA256
46999c3401b5f79fe6f2e25277540a3899bcc0364e2e29d183c91d9907161ac2

SHA512
9f4c0d5169f424fb3464be49e1e3ce05dbe9071394d0a12a6c400d5ec2f6b69b205eeacd1fa3704974e78b6148142606c6bd6af743bf5076b9669bcef5063929

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
3bb1527d0a6306d507e8a60179381264

SHA1
6d08cb15da4fc6959da2315aa9edd51d86aca0f4

SHA256
d51f82f80d58dfed6115dd8254c66fa4af790838b08db24d220758dfa65b7749

SHA512
3ca88b2214713fe777cdcf900616508ff4423655a09f7dacb9babea0b5cb2cbdfad678e82625e29749aa3847813140173c62ed00a36f555bc7ff939f96fa4846

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
3394d83ceb160fd795847479726d53e2

SHA1
e27ef50aa500d6dfee5bbd046fcd0f8d5f5b3fae

SHA256
faa6822c462904eb0e53fde856827ef27b147ffb564dbd86fdc932c69fe27471

SHA512
09528cc1534d2176f5647edb3fa5961b2aaf139cf60c4d69ca927664bc8ed4e3e9d6886b3adadcd46805ae193e5b91b49a2c353d952df06a77a6ee3e4e0d54b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{1938CC97-94D9-4F1C-B519-21AC324E505D}.session

Filesize
4KB

MD5
85b2de0b95a687a2c53d2d80d70f7113

SHA1
010d2239f77a926f3d37cf729bbc0b31517876a9

SHA256
fdae529fd21a7c501a4d0dba5f1916127ea60ab61237336adb053e50ff753561

SHA512
3b2a47ac261c535c9d6e6c57c55bab0c08cbaed942193257fb26218778fbae6030bbf99e7bd7b23ef33a6db594425b60f4aec0dfaa2472e0bcf2258bc7597a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{2340576F-CD96-486B-B332-13C9E778F856}.session

Filesize
4KB

MD5
7472c0d35c3196837486b5292bf9772c

SHA1
20bf2cc9a0c616ea3a1946ffb59a1dcfcd6d148c

SHA256
f4b8907ba130b7498926df59f09a463760c26c8309c5316495e6823953ff13fc

SHA512
27f62a3b30d7fd872cf6d5b7c4b333a18c2feb4ce14b9e553a474b48a03110234f8e6e076a8a1221f1b3ccb05d4b5d36893e9499fe899cd29032712ad8f9c920

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{2340576F-CD96-486B-B332-13C9E778F856}.session

Filesize
2KB

MD5
341541c652fa0782d606bc5dbb6e8245

SHA1
637f23c3e55b5e6a9e2d2b1acf351dcb47aad05b

SHA256
e96e978c857228fcb7d796e334dbc8e1419908cd8369259dab52f14906e954bc

SHA512
ffc46d9108e5ae633b23cb6836384b8295aaf51b162506820b52a90dd9ddf6d1b636ad579291ff1ba2825c9b9b67433eb96fc7e3a7bdc75f4531ca124f28d154

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{2340576F-CD96-486B-B332-13C9E778F856}.session

Filesize
3KB

MD5
8c55f9c18ee75f0ed6e8dd6a5cae6c13

SHA1
128a1ef07ae5b71d58cdf8e6bb454aec816a7aad

SHA256
e04edd4fd2b3c767a42a91c4717dd6bb62daf68894ca09cc12be67820e8608e1

SHA512
2cddd7fa76a99f7378264ec276ce7d9a945ebe9851ee167fbc11fea5ee680d0ee15790d59872823e8afe04e013902fb8bd013fd789a4c55d98b930826bc9cf2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{ABB30341-D40C-482B-9576-EAF478CB7264}.session

Filesize
1KB

MD5
3ac6000d17fde5089a19dec153ad0727

SHA1
986fda152307f0d7dd11cd70cbc7e0942fe31f9f

SHA256
a6f12ad0293d3fda973a28453386606e618108a288c1aa79f0117d5beadcf2eb

SHA512
956b2847c6a623c347e49af4db3f420f67bf2596f861609ebc9cf84866e52493cded8e466e6413fe708d82bb8d1786122e843817c87e05779eabd028cd97a01f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{ABB30341-D40C-482B-9576-EAF478CB7264}.session

Filesize
1KB

MD5
5a5c317e4347bf7b1da773920fad0e32

SHA1
24c25f64347352cd4dccb3193ab185fb9ef6a958

SHA256
0aac47374b67226040bb19d670a3b392714b830bb615a3ee89b834caaca34c27

SHA512
7dba356c3ded4ec1287183dacba0f13571bac30affee9f38e2818b2bdfe75c933a2778e6db7007a69c2262b73a0b14eb57d75102ac5cd6626fa69e4373dcc20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{ABB30341-D40C-482B-9576-EAF478CB7264}.session

Filesize
4KB

MD5
3e704b0bc5e3181133ea3ceafd0f8fe2

SHA1
b4405185fb74e2c55e932e69d144454df96e4ad9

SHA256
e359a29b280926b9a22b211515bc4e62e29ac2f378053b89f8f0f6669d9bf887

SHA512
bfc5fbed29c2ead9c8140ebbf786932f21a3179c032ea8d6ded64266f593002180f68f98dd76e1e2f42cfc225e8d89780d8b09f34077d753820c637ff0e7a4e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{F82E43C5-7F8D-45CF-9392-80E7781C12C7}.session

Filesize
1KB

MD5
3cacc7a1f5f6c391012ae213a3b01e65

SHA1
258f81c463c5a5ddbefa8b3ccadfb88388941fb0

SHA256
5d6a7f1858184e1b85299fb6ac60859511e11b848bcd5eb5b45d3b2aeebaaa4b

SHA512
1e5c5b5c051cce912301344ef1d6ec1253cb04cb6fb915998e0fe5160677e064021856a90134c42652be4185d8e39dade831767a83c0167ba97ad0e44d945b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{F82E43C5-7F8D-45CF-9392-80E7781C12C7}.session

Filesize
2KB

MD5
7d3078eae947882c4ba69b69dd6ef94e

SHA1
f27cba3669aea664269cca55c014acd01427a78d

SHA256
ce39ccf3a1115d573ae959c89b15786d4da4d4861203cf08b58328dd2823b85d

SHA512
987bd67e6fe8e0078a278f4bfebc879b4e0056f618465717766777ca11ec355f5650e96c40be585c2c1954b251faa460f9a0fd3dcdfc723d3a28391c9dbfae5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{F82E43C5-7F8D-45CF-9392-80E7781C12C7}.session

Filesize
2KB

MD5
3a7d07559c56a4f08d8d66628aca767f

SHA1
f9ca23d918dc22333061f2e48cc51327c71428b3

SHA256
e95645dfc68e31d6bd3b412a9136b166e9182d13347c763ace3752e27bf5342b

SHA512
3f0907062e754ccaf4018133748fb03b6120837a24c5a2711550c10b4a13b1b1968715d8200477a43e73b0b9559440a322819ecdf0119262ddaed2fb1e6c8f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{F82E43C5-7F8D-45CF-9392-80E7781C12C7}.session

Filesize
4KB

MD5
98815545855504e8e42e8eb623c9d128

SHA1
bad41b93908cb622706fc155a2678cfaaa817ea4

SHA256
98dfd27a80697bb86c0ff2cd4cb5998ce3ec30c9eaf1d5cf0305ed87f5523d31

SHA512
5f13a2bee7513aad9157c314d4222621fdc6d9613777b2fac6f6b0399658fbba55859155bc47e13ac4ff19b0e41604a6f47b55f49188d85908dc92bb760fa0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\shiD538.tmp

Filesize
3.1MB

MD5
aff55ff1a0d686ad405855bd22a932d6

SHA1
00b5db2b0322b2aad7aebd80d1d13372eeb85832

SHA256
926a128e1ef90c09470460fab0682fa500640b96ad3ad6fd8efaff9ed46e97db

SHA512
19bccc43eff166e1c701713edd6279d6c55b1c1277c2391eec73e6aebd201db762a52fc5a764900ac04441e73c573703ee29944c6c0a8e59d90b46b3279cd11e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
e89126bdb14e858c4be70cc045e181a4

SHA1
da1ea9f4b9e771dc2395da9e43e8800a7c74e6f6

SHA256
f5d458a4dd939b485a8680100dd9d6ece800ba4c874a977b611019da8405b1e1

SHA512
131ad8d0749b41662a343fee8a8a5f902d792ead2dea088d7f4b587530073c273f3bf8c139866a6a2572fd868d53fe1e2caeaa577fc6dad334d6b7f2cad2e643

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
4578aeb7560d145926a6558c88d8934b

SHA1
864fc4b31f6ba3207c0eb2b9abd4227f265b3305

SHA256
55d4a2f4f487dbb4ab3f2465df70b36dc5c3345c56586ed643a51e6b332a2f6c

SHA512
77c0a7415694d936a1e20fdfc3ce702f5e6eb18578e6113128f9e7b78cf1b0baee87314359831924e7a4d1f79473d7918a309548ea07afb1241acf33b14af78b

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi

Filesize
1010KB

MD5
27bc9540828c59e1ca1997cf04f6c467

SHA1
bfa6d1ce9d4df8beba2bedf59f86a698de0215f3

SHA256
05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a

SHA512
a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav

Filesize
724KB

MD5
bab1293f4cf987216af8051acddaf97f

SHA1
00abe5cfb050b4276c3dd2426e883cd9e1cde683

SHA256
bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344

SHA512
3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\fatalerror.exe

Filesize
24KB

MD5
e579c5b3c386262e3dd4150eb2b13898

SHA1
5ab7b37956511ea618bf8552abc88f8e652827d3

SHA256
e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2

SHA512
9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll

Filesize
126KB

MD5
3531cf7755b16d38d5e9e3c43280e7d2

SHA1
19981b17ae35b6e9a0007551e69d3e50aa1afffe

SHA256
76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089

SHA512
7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd

Download Submit
C:\Windows\Installer\MSI985E.tmp

Filesize
88KB

MD5
4083cb0f45a747d8e8ab0d3e060616f2

SHA1
dcec8efa7a15fa432af2ea0445c4b346fef2a4d6

SHA256
252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a

SHA512
26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133

Download Submit
C:\Windows\Installer\MSI991A.tmp

Filesize
180KB

MD5
d552dd4108b5665d306b4a8bd6083dde

SHA1
dae55ccba7adb6690b27fa9623eeeed7a57f8da1

SHA256
a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5

SHA512
e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969

Download Submit
C:\Windows\Installer\MSI9C1F.tmp

Filesize
96KB

MD5
3cab78d0dc84883be2335788d387601e

SHA1
14745df9595f190008c7e5c190660361f998d824

SHA256
604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd

SHA512
df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820

Download Submit
C:\Windows\Installer\MSI9C7E.tmp

Filesize
128KB

MD5
7e6b88f7bb59ec4573711255f60656b5

SHA1
5e7a159825a2d2cb263a161e247e9db93454d4f6

SHA256
59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f

SHA512
294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c

Download Submit
C:\Windows\Installer\MSI9D0B.tmp

Filesize
312KB

MD5
aa82345a8f360804ea1d8d935f0377aa

SHA1
c09cf3b1666d9192fa524c801bb2e3542c0840e2

SHA256
9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437

SHA512
c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db

Download Submit
memory/1208-920-0x0000000007370000-0x0000000007382000-memory.dmp

Filesize
72KB

Download
memory/1208-919-0x00000000068F0000-0x0000000006A7C000-memory.dmp

Filesize
1.5MB

Download
memory/1208-918-0x0000000006650000-0x0000000006754000-memory.dmp

Filesize
1.0MB

Download
memory/1208-917-0x00000000057E0000-0x00000000057EA000-memory.dmp

Filesize
40KB

Download
memory/1208-916-0x0000000005990000-0x00000000059E6000-memory.dmp

Filesize
344KB

Download
memory/1208-915-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/1208-914-0x0000000005800000-0x0000000005892000-memory.dmp

Filesize
584KB

Download
memory/1208-913-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/1208-912-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download
memory/1208-911-0x0000000000C50000-0x0000000000CC2000-memory.dmp

Filesize
456KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads