hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/trojans/Illerka[.]C[.]zip

Analysis

max time kernel
210s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/trojans/Illerka.C.zip

Score

10^/10

discovery evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	[email protected]

Executes dropped EXE 1 IoCs

pid	Process
1860	[email protected]

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	[email protected]
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	[email protected]

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File created	C:\Users\Admin\Desktop\desktop.ini	[email protected]
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
88	raw.githubusercontent.com
89	raw.githubusercontent.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	5116	WerFault.exe	142

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4936	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
4636	msedge.exe
4636	msedge.exe
1720	identity_helper.exe
1720	identity_helper.exe
776	msedge.exe
776	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
1860	[email protected]
2692	mspaint.exe
2692	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4148	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	4148	7zFM.exe
Token: 35	4148	7zFM.exe
Token: SeSecurityPrivilege	4148	7zFM.exe
Token: SeDebugPrivilege	1860	[email protected]
Token: SeShutdownPrivilege	5116	wmplayer.exe
Token: SeCreatePagefilePrivilege	5116	wmplayer.exe
Token: SeShutdownPrivilege	2444	unregmp2.exe
Token: SeCreatePagefilePrivilege	2444	unregmp2.exe
Token: SeShutdownPrivilege	2612	wmplayer.exe
Token: SeCreatePagefilePrivilege	2612	wmplayer.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4148	7zFM.exe
4636	msedge.exe
4148	7zFM.exe
5116	wmplayer.exe
2612	wmplayer.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2692	mspaint.exe
2692	mspaint.exe
2692	mspaint.exe
2692	mspaint.exe
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4920	4636	msedge.exe	84
PID 4636 wrote to memory of 4920	4636	msedge.exe	84
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 2568	4636	msedge.exe	85
PID 4636 wrote to memory of 3400	4636	msedge.exe	86
PID 4636 wrote to memory of 3400	4636	msedge.exe	86
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87
PID 4636 wrote to memory of 3280	4636	msedge.exe	87

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	[email protected]

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/trojans/Illerka.C.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c4a46f8,0x7ff91c4a4708,0x7ff91c4a4718
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15805287793436194077,4516942556619516019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3324

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Illerka.C.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4148

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1860

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ConvertConvertTo.ico"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2144

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5116
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2612
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 3000
  2⤵
  - Program crash
  PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1632

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\CopyExport.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5116 -ip 5116
1⤵
PID:4932

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c926b022b30ac1d4bd2b5a6d2791fc92

SHA1
13df7d022f959ca572e8acc5b480aac2501f0873

SHA256
3984144f50103e3bac777e17a20eb4f0f002d2f648291fc06e1871544ab746de

SHA512
73958af0c51f49107ff68d908fc6a2ddd39bd226865ffa5308fe083a500a3ac59c1f7a07f0756e42ed0aeca64078346aed08627c8f4ff2bc110424f1e681ce54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
5d8dbe80caa9f2c87751d6734053222f

SHA1
5d3c47ff45a6b3ad784d9ea5732a34df7959ada2

SHA256
8077494a95cd2b0323601d5285470c675cd1bc9c702708a14085b99e8a70e9f8

SHA512
a0733e6fc4395c6265263affd4c4124733704a8fd0e3a3903680341019314605b08fa5a2c00261f67eaee408741ffdcba3aafb7c99ad62172db86a7434ed6fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
9a6ce27b8d0b8451401204291e83d579

SHA1
0a94eaae0e37289b3ab5c634d886579f01f8cbab

SHA256
475dd5afca6828b19833bdabdc3d287a2a147dd8d6e8abeb42f5927e3ed903af

SHA512
bcc5cb6b95208daf67402adbab62269fa29f6406d88c5759344887c109285ab59625f94f139fe92fa4dcea2151d7e3d2455484272ed6399370e4452724497785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
417aa495cd5d680a4f29df66d852ea8b

SHA1
a787fc58dc8eb4108a3e07c9f40af6c08519d07d

SHA256
200741c1d9bca92b91df6aaf02b8bdb158a1bdee3a631cd4318588024811a5ff

SHA512
70dcfaf42be1554fdbd557a633da77f81ee8858a3463e01f196d9fad5fdaf1747870e07e4da5f8daf08a9ccfa76316329cc0b05d0bf123e6bdb262c2dc7f9996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0d0dc2bbebad6309c4e334a4d17cd02

SHA1
05d7e95dc49cfeb067c670224d8535673caa773e

SHA256
d1b5878e2e84e73ddbaa826e4e8453773179173629581e72ce821d7ea6cd4fb6

SHA512
243783fc3ca8aa1fada781fabd791f8d95fe06ad4877e748febc80f907039e780dc137ca549901489bd063f1713ec74e2a9899e444e62285aa9f3a1795608d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1599ac597089ae0da38d668e2e26eb31

SHA1
dd5350b32433770e9176882cab665d31c360fd87

SHA256
209e9d6ed090638c51038ea6f57f05f0d6446f867bf86ce04a61177787421281

SHA512
9033e0292e4e146739ae3e3a09e35f022b316387debf1fa3b83aef0110d9c0005eaae2023273f339417f5d3600afb5a6fe7cf50b342e7fe6e9efa5baa1869446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d3368d14455fa66b64a9b6e51c86d60

SHA1
6e4471338d046c4bd1955a1bbe0d97b4c771111f

SHA256
43f94f8e5231994ff4535df1902012196b21b1b984f45588957892d037c0cbda

SHA512
d061e86f48b7cccb5de5fb4fdaaf18dad147cb4dcf4a20cb66f4b5ef2a95db19e7834d00924aba4a60ac34e5c05e0d032b8a35cef4853a6ae5960c53985788a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
7351bdecb171095c1bc082465e19d7e9

SHA1
0389f399de5822fe290341195d3c6edeeb647c95

SHA256
60dd06c0e098eb819b17a5995ba0e0c4da7eeddd4beab353781db5e1a8a263b4

SHA512
298bf5e913a829984120c98b367d21bcac662fd41eac089aba882a624d57c291c58656a7df44e9ede8e8d24ff17ade642b8fdc6df43ba9b482a8a7ba5272577f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
68150e2ff8ddcc507215f720c8eed80b

SHA1
5afa0e0edac5587389ca64ad652dd6d7ee4d9da5

SHA256
2ede086e85df054a4aba5bf0dcf3b076ca93f160f80edd9a9e38b4aef65bb4dd

SHA512
fb3582d23c9560a36a01b5edeabf007e61d57b273db6f878b2441103d1f9bb3c954baf16ab6913d1109eaa22ad9a9e21d2a77a720ab3ff9caa9654378f4cc783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584d7f.TMP

Filesize
706B

MD5
55e5d44f04e6b7dc0bfef02a310f4843

SHA1
45dde67178c1fba5503ff3cad66d11ded43a24ea

SHA256
3cbb117f29e2bdd5b7c0c7b352e14bdb28d5e7bee19427dacbd95ed952ab419a

SHA512
95ff9fd820d99c46125c31de4f317fc3d02d4694384263553f3b266cfff1eb8394921ccdf8926e6ec0d41c94b3194d5a43bb4978a9034b1ff932ab3672694b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7040691518c075eda10b8b1e148b236

SHA1
fd343a4dec511e1f3b0df7010eb3e70eb96a9768

SHA256
47a23f1dfae38e7bd70a431e0cc60d47f651e17d72d35b190d55a238eaaf02f5

SHA512
54e0bfddbeafc04d409d7f857690471240b76d40c67d334ba10683ebc08d5d471cdae5d9e37cd811c3984541906c8c729f92ff46d4c8697b848818cd3d4795eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1bd0d477960c55421162c825ddd9ccad

SHA1
179631924829f100c8b6d020e0314a5ea2df88bb

SHA256
c206fe6465185c617f3c9f3e57ac55325ba9ccf37f11cca7acb04b89615f4a5b

SHA512
0b83b86131b4e128a3b5a0b58f1ce80fa78eba15e09aa06cd957272916dd56c876d99d1a725fc25cc17c6f999292289b7c0c48bee74a173dab7657584e0ef550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2ae46cff63d53034e5b55cdd399d9eda

SHA1
9a89afc5e6a8b323184010b131fcca03b346a25c

SHA256
1b7a2dd6b06333e3c3e1d893dfe7c23e6cfd7c2b7bee3f73577c17b4cac06bde

SHA512
718f728580d16a1fff2151f89b2737963f2472f06ebfc901bc36d3cdbe7725214e275222a480082d8a68d051b1f9fcbe51f1019e272c8267002ec260ffac512f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
be1b718d991b02907a23cf87a6ff7988

SHA1
ef6b72e2b8a8fd5891bece855cd297d3754cb906

SHA256
cd1daf8932ba71907898b1c75ca474a7ff7e13f5b8f9370d96880e395079367f

SHA512
6fd43d5d342c77d3e6b7d15dc185a76798873d3edb7bb5929f138dcd117f459863f623957007d241751fdf29838454be429bcf37d23096656185b598ca5291b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
987a07b978cfe12e4ce45e513ef86619

SHA1
22eec9a9b2e83ad33bedc59e3205f86590b7d40c

SHA256
f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

SHA512
39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
d476919e3651b9a06dbe779c5b704c23

SHA1
79c0859b7f1151cb336000374e78623b05be07a2

SHA256
7e0a5c59a8d3a18f4c3b93d67caf5e324d90a82fd384c9c47bf68833d6463be3

SHA512
12f8010fa06b4eed7c27296c6f79608a2ca0e5ef8e989b51598c857c5ab69b7aaad9d34f70bed5fb53eed3a036909c528f4f09ae2a16e1db33f670361c95a430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
04faae6be8899d8bf1eee327abf728b7

SHA1
8576d9ce83037129ca083aae2397fd5d5d31e847

SHA256
96cb58ed737b5efa593638d96cd12cfcf4c6001b6208f99431eab98ac4bfc358

SHA512
97306a30587744774ec6224efae3df6bdd2128b760bd976469d856f384698762c168cf73d62325af94aee1089f2ecf8056954f8b41cdd7216a290cfb4b1f6c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\lastplayed.wpl

Filesize
359B

MD5
ad9cb4f39f3e230d2885854d6f4f72b4

SHA1
ac506de57da2cc6df535185a90a2588df4089893

SHA256
a889fbb6f1c6af0e1952f021147931810ef75587704792eba49c88bd6fb72eec

SHA512
895a669b0226c22dbadac7128b30a61a71c111900b980f4bede5ebbf1ebbfdbc61be2e428b5769023dd59e8111273673c13101abfeedd551e90b845cb9d5fbe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
9f909f12fd5d5ae188cd8a4d527f1adc

SHA1
7c2c51420a01139018e73f1e84e94cf771f66336

SHA256
7d63ed42f36ee9a6888c7559f8fce6300eaadf195f47da4197de6fbc81478be0

SHA512
bfa7e27286e76ee715e38d0a6713900f858c06abb1304d8472738fcf496e9d346307d9157e7e9b568f5768dcaf77a499302af1e5572915bdd6997316233ccce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
1170000ec3052aaeb4d28e052390faa7

SHA1
7f87555957e229d349fdff1e423604b20e29d0c1

SHA256
0a8733d8b6133987cf7ce0909f34869d559ad7921f414e73d29df6ce94ecf0ac

SHA512
2251bd157792e4c4e42dfedd8584b21ad439be2257d3596f80754b963e36f82dde62246c1e7516ad2b2e58fd4e2b6fc7800ef5821dde8a8909b8861474d057cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
e5bfda0dba4e51318a072949973a3820

SHA1
4f5ec5f6bbc60f2464e09edc78d9cc67245a99ce

SHA256
c05184b612eb002d5cc8b0f02cb8c3100adcc129cd405cd538f0814ded1c0f19

SHA512
dba39356d50c68c5c3efa65f843d12b1a8edbfd841758a42c1036174c0f69e2eb66c23a1a4e0b60ffbf2c5adf6b110420210a3ceb73fec05ac4ad96f4d4c3b4d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
01b09ca52de903d7b5a88f8637494745

SHA1
018108fa421a82da365d8d8f5d065ea90564a582

SHA256
d579109fc0582177608016d825430ccea69ac4b44c4971533157315b30ebe521

SHA512
578b58696fb6aa53824c31c32a181b9fa350544f3cd300a7d5d10608f77d2b35b81966047cdd3a5cec34d609fbf6d89e21dad4d6e59e9acd2b6670153e933dfb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
f0cf93543c407e503090c25a2cd53dcc

SHA1
67d7ac897489ecf3a75653c9b5ab110c19f7a735

SHA256
be5c19edc19630e384173448f6a7544930a90e4553c374aa8b9d72eead5db4e6

SHA512
c977c7c0583adbe89d063e5b37d0c5c7156e852547fde6aaa287a32cc3a3aaf123bf6a72f0dc68933e8534d3f9d4a5d7eec5d5bd877975677bfbd2ba1f534bc4

Download Submit
C:\Users\Admin\Desktop\[email protected]

Filesize
378KB

MD5
c718a1cbf0e13674714c66694be02421

SHA1
001d5370d3a7ee48db6caaecb1c213b5dfdf8e65

SHA256
cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f

SHA512
ba0ddff47b618740dfcb63024435c36d895889dd3cf6b4559969283ba8100e8063f5c7767e56dfab67a2b5c96e4ae22e141e5b09e81be5cec9aa7ca7827b4b8a

Download Submit
C:\Users\Admin\Downloads\Illerka.C.zip

Filesize
64KB

MD5
9f7249077b949c96bfa3fbafc38e4ee2

SHA1
1fec3d58de9f782dfaabc323222f89adea6b7d05

SHA256
519fb20d9caba12bac93c363bb64d8bade4971fad49e8bf489d1e512784c28c0

SHA512
088ce74aee633ae25ef764555f1a2686f32efde5b28cb1afebad9926ab69f574506e3dc68b7b2d8f966bc19b96b50f9cbbd28beed0afd70cdad6d77581e072f6

Download Submit
memory/5116-541-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-559-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-519-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-525-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/5116-527-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-530-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-531-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-532-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-533-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-534-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-536-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-535-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-539-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-538-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-537-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-540-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-515-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-542-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-545-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-544-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-543-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-546-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-547-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-548-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-549-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-551-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-553-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-552-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-554-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/5116-556-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-558-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-520-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-560-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-562-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-561-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-564-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-567-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-566-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-565-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-563-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-568-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-569-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-573-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-572-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-571-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-570-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-574-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-575-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-576-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-577-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-578-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-579-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-580-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-581-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/5116-582-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-585-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-586-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-587-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/5116-514-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-516-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-518-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-517-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-513-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/5116-511-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download