hxxp://ptoszek[.]pioterontop[.]rf[.]gd

Resubmissions

02/09/2024, 14:18

240902-rl82esshra6

02/09/2024, 14:13

240902-rjwy3ssbll3

02/09/2024, 14:12

240902-rht34asarm3

02/09/2024, 14:02

240902-rb89fa1hpr3

Analysis

max time kernel
31s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://ptoszek.pioterontop.rf.gd
Sample240902-rht34asarm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "58"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
868	msedge.exe
868	msedge.exe
3004	identity_helper.exe
3004	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2504	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4888	868	msedge.exe	83
PID 868 wrote to memory of 4888	868	msedge.exe	83
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 1540	868	msedge.exe	84
PID 868 wrote to memory of 2308	868	msedge.exe	85
PID 868 wrote to memory of 2308	868	msedge.exe	85
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86
PID 868 wrote to memory of 60	868	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ptoszek.pioterontop.rf.gd
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94f546f8,0x7ffa94f54708,0x7ffa94f54718
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1108757524048235927,10098151392721608210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394d055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21b07e8b-9ee9-4255-8612-df21aad3da8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21b07e8b-9ee9-4255-8612-df21aad3da8c.tmp
Size 10KB
SHA256 ce6187a479ac4b2264d78e624bc6f4c69a87c7c8c486862463bb6fb385321466
MD5 ec4e1dcce5f2b674a253136618cb307c
SHA1 bb7a998276a12587681daae7c6ef99ff3513157c
SHA512 d88a2f485c971cabeb87693d478473817326449e57c014bb07d7c4cb846eee70c448924b446ca3110fbdc1eb395e2fb0531cc0519ccc1d3d33b6ef0006c60a47
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOie2RUTr63Rw5Ytj9Zklq6:A9iIxuERzA83h09RZxY9LQkLs7
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
MD5 111c361619c017b5d09a13a56938bd54
SHA1 e02b363a8ceb95751623f25025a9299a2c931e07
SHA512 fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
MD5 983cbc1f706a155d63496ebc4d66515e
SHA1 223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA512 d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 879f3f50f8cf552e90db5cbd1e6aae2c89c14fc0cda9b0e40ee9fe06c2b86741
MD5 9702e295628d34d5078136ea394231c3
SHA1 e70e1bb4fb9ce8e084a3e77c0678d814683c0014
SHA512 85d5ef8cd8e2013f12df71a7aa47d5579e7cd7130a51b6b99244e758f5c550fc4d9971a5e1b4c7b8c69a724ecd6d836cae5409f295a233724dcc4ad12cf042a1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 28b0dad77b6bb267687c63e9e72547f20576331d10770ea22f39bd8289bb9ba4
MD5 e06976fc2ab8beac2f1663acfc50c9ae
SHA1 74a105f7a2cf0ff68977e9e27bb22eafb70e94ad
SHA512 aad9cd583addad36dadfb72f3251a3f67498ee120ae4b921365e9413107268746ef508ed1f8b463baa625af5c691784897d8754a778e6024087cac3e0a417a2b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3dd027cd4ca904b4f4df544bd64d1bce5a4e9de2873cf51b0e287d6a3697c6e3
MD5 f5f7ae2643d9877cd663d862c54af6cb
SHA1 25ee68997615a60fc4d90030c1e27524292cac07
SHA512 bc8abfd03867ebc23474569f65bd56dd4c8942562246800d9a751885a31f976736edba44017a0df7f1f60871a5c005847a5d97e5d90c425893bfa10c8765167b
SSDEEP 96:nKk/nF18kbwpvWMoiTR5mdeIu+1nG8HGqq2WjUWQyV+VD7AiEwb:nKk/Fa8GWMTWu+hNqLrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fcdefd73b917ac91898e8669364e027b8bd1fed4d01c86655f209c42c5b66b40
MD5 e605cf05368695de63bc5102a7f7c99e
SHA1 dcb5c134cca46b93a09f22eeaa1ffbd7dcbb688c
SHA512 e2620f6bda07eabf562a63fe2326c28abe76f5eb76df719353269c96f8df10b12fab395b2c5ca5b3d082f3b4c9af83112cf800b988c2c96918cb276488949875
SSDEEP 96:nKk/aF18cbwpvWMoiVmdeH2FjUWQyV+VDCziEwb:nKk/OaUGWMXgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 256acb3ed58917a2ab20fb9590541f95bbc9a066efaf4fa853d0a95a89e69581
MD5 c5c58f1bf6ba63bfa9e8bd54b1dc80fa
SHA1 38a89e7d3c9ad60e62e597b61997be067f81d3e1
SHA512 0a5bab8f42351f2b088083a1fdbdf9e850ef32a2fa298475e68fd2569280e45dee192a2e588d5f633900f36e49ee2aae408920b90487519a9a38d89bccf274b1
SSDEEP 96:nKkWVF180bwpvWMoiTRvR5mdeIu+1NyZhzG8HGqq2Ou4yWQyV+VD7AiEwb:nKkkasGWMTRWu+zyZhNqM4lg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 79968567786e82c021cd55575e6654203e9d7b292493fd74b255b7ee854da15b
MD5 bba2827e35b049b89091c4dca5d5c01c
SHA1 47231477951354c2a8960962e98905c2b9ab9eb3
SHA512 60e9936b62151d958a20f218cc57154885f79e47d5ac859a4c748bd9e424244d9280857df7facc403b43f12422482d309c89d76eab3d2f9dd7c310092372d5cf
SSDEEP 192:UoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOie2RUYr6KtRw5Ytj9ZklP:09iIxuERzA83h09RZxY9CKukLs7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads