043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2024, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe
Size 566KB
Sample241029-yeacvayfpp
SHA256 043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9
MD5 67f8b2f83aa50da8186f03e69358c160
SHA1 e9010ec5abfab7162ba0caf507d3246f6680bcdc
SHA512 66d5392f7a10a4e1beded35b41e3e4c73fba4a2a9cad4139353c29b7cac04fa9babf9049054eaa4c3475e52dc6854734a75a62480eeb8e5258509a90c7aca6df
SSDEEP 6144:etzgx2GdlblXkmatlBF7MuJGSN4r8jZlIPMTaE+q4Ow9waqgpJOuKWK519CkBOwh:e0nlXkXfBFINSdwPbQvbgyv7O/j
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery exploit persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (8618) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2936	icacls.exe
2044	takeown.exe
2288	icacls.exe
2788	takeown.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
4732	Termite.exe

Executes dropped EXE 2 IoCs

pid	Process
4732	Termite.exe
4832	Payment.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2788	takeown.exe
2936	icacls.exe
2044	takeown.exe
2288	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Termite.exe = "C:\\Windows\\Termite.exe"	Termite.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Payment.exe = "C:\\Users\\Admin\\Desktop\\Payment.exe"	Termite.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\mswsock.dll	Termite.exe
File created	C:\Windows\SysWOW64\mswsock.dll	Termite.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-150.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-100.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24.png.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-400.png.dll	Termite.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.dll	Termite.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-150.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\refresh_16x16x32.png.dll	Termite.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.dll	Termite.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt.dll	Termite.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteWideTile.scale-125.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\BlurredGradientBackground.png.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\processing.slk.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png.dll	Termite.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp.dll	Termite.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\hmmapi.dll.mui.dll	Termite.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.Format.ps1xml.dll	Termite.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-125_contrast-white.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_stats_render.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-white_scale-100.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\28.jpg.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\13.jpg.dll	Termite.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-57x57-precomposed.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.HCWhite.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_altform-unplated_contrast-black.png.dll	Termite.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close.png.dll	Termite.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.dll	Termite.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Reconnected_Loud.m4a.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-40.png.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png.dll	Termite.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Other.DATA.dll	Termite.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.dll	Termite.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.dll	Termite.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png.dll	Termite.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png.dll	Termite.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\153.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200_contrast-black.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.winmd.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_share_profile_v1.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-72.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-400.png.dll	Termite.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.dll	Termite.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml.dll	Termite.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-48_altform-unplated_contrast-black.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-125.png.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\SignInControl.xaml.dll	Termite.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.dll	Termite.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-80_altform-unplated.png.dll	Termite.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Termite.exe	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe
File opened for modification	C:\Windows\Termite.exe	Termite.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Termite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\	Payment.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\EditFlags = "2"	Payment.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\Shell	Payment.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\DefaultIcon	Payment.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dll	Payment.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\Shell\Open\Command	Payment.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\Shell\Open	Payment.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\Shell\Open\Command\ = "\"C:\\Users\\Admin\\Desktop\\Payment.exe\" \"%1\""	Payment.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dll\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\Payment.exe,0"	Payment.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dll\ = "dll"	Payment.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4504	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2788	takeown.exe
Token: SeTakeOwnershipPrivilege	2044	takeown.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4504	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe
4504	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe
4732	Termite.exe
4732	Termite.exe
4832	Payment.exe
4832	Payment.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4732	4504	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe	84
PID 4504 wrote to memory of 4732	4504	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe	84
PID 4504 wrote to memory of 4732	4504	043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe	84
PID 4732 wrote to memory of 2788	4732	Termite.exe	85
PID 4732 wrote to memory of 2788	4732	Termite.exe	85
PID 4732 wrote to memory of 2788	4732	Termite.exe	85
PID 4732 wrote to memory of 2936	4732	Termite.exe	88
PID 4732 wrote to memory of 2936	4732	Termite.exe	88
PID 4732 wrote to memory of 2936	4732	Termite.exe	88
PID 4732 wrote to memory of 2044	4732	Termite.exe	90
PID 4732 wrote to memory of 2044	4732	Termite.exe	90
PID 4732 wrote to memory of 2044	4732	Termite.exe	90
PID 4732 wrote to memory of 2288	4732	Termite.exe	92
PID 4732 wrote to memory of 2288	4732	Termite.exe	92
PID 4732 wrote to memory of 2288	4732	Termite.exe	92
PID 4732 wrote to memory of 4832	4732	Termite.exe	98
PID 4732 wrote to memory of 4832	4732	Termite.exe	98
PID 4732 wrote to memory of 4832	4732	Termite.exe	98

C:\Users\Admin\AppData\Local\Temp\043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe
"C:\Users\Admin\AppData\Local\Temp\043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\Termite.exe
  C:\Windows\Termite.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\SysNative\mswsock.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\SysNative\mswsock.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\SysWOW64\mswsock.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\SysWOW64\mswsock.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2288
- - C:\Users\Admin\Desktop\Payment.exe
    C:\Users\Admin\Desktop\Payment.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

s_remove_18.svg.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.dll
Size 724B
SHA256 7f82b4c1712cfedb804e42f82ea5f54519a52cb90a45995f29dcbf23079f3403
MD5 ef9801bdf8924c6b1a6def15acb830b0
SHA1 862ab3b128f87cc4898810d843de5cd85b394733
SHA512 ad8d8ff08f93fc4301ad3201273668844fcb6db4e90a32b90c58957e4b21e6ca129f4a8ecb2f635527ea88618b56b68e3c0d5c34e71ac594aef957d512bd73d5
MD5 SHA1 SHA512

Submit Download

example_icons.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.dll
Size 692B
SHA256 bb40f675085b72d82dd0b5051c89f584809461f3e4e169b864520c330a70b03d
MD5 f5c838a29847494e6d62531d53237df1
SHA1 0151d7b80459fd2f62c5478826923e3386723230
SHA512 a7febc6ffdc59d0df585d62544b12bd3c7b3ff5d8c02f9421d384dda86555d3698c7128ebfe26171e7c2a8ecbbfd88644e4ad5f091421379391de748230417d4
MD5 SHA1 SHA512

Submit Download

example_icons2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.dll
Size 1KB
SHA256 fd435e9346db7a8a13dd5290ebcae349edee89ebbd1fe74f6e38bb8f8ac09b4e
MD5 524d57d262e94831a14b4906a71f1c06
SHA1 f8fe6647ab50a6cf004a79e3629c061130a00e78
SHA512 6425442c5ad19cd18d672014089d943a01a6e7d0f99f2915b081b08afb86894a3f5331aba14474491e6924868a4190feae469ba9a1e9686305b3784adce71872
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.dll
Size 460B
SHA256 4b8ff7ae3930b3537b2de256cb8972d7041660c8dcc2ac8b44b41bbb8832f9d1
MD5 518e5814110017be1cb34e82a9454f67
SHA1 633e5c2660d1642c57f6f5580bd660decb4c5368
SHA512 2d35b68bcff054c63790b3da7d7ca02f0642c2d6922632ecaeab4d9ed401f6e7a16fcdb1b1ae30320d4cabbee3ee4144ea8d3809ae5871f423cac43de095e8e4
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.dll
Size 620B
SHA256 0cca6f5959fb85eb94176c6141c8d6d5c40bc58640c19eaba5f817a626fb8538
MD5 f7210b4a5277fcfc8ca42af78ad48267
SHA1 5734ba24b7d404cc2c3693c9dcd4e34bb4566b58
SHA512 2bfbf5469b4fc8ea1410fa76895eff60e9440b8be57fccc92b3a38f9f3747cc8df6a3054a5c810f19915f92a1a52625b8b802d2501b74de28214ed3c7ca561b7
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.dll
Size 396B
SHA256 2f9e39e7f412bf6a54973f8b4efd65bdbf3dafe483087a18d0a0863506459684
MD5 3e1a7a8aa1e576223b15d1b779d914f7
SHA1 13c06b99a50258d9bc0ab3cb5c019ecacfb06f65
SHA512 8199d2a47696d239c61f65b4e42a4907af31e097920b7beae8753c3d9985a5c8984dae58379adad715f9f9bc19da1b38106e412de5554edf79304b5eba46f486
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.dll
Size 564B
SHA256 f0f53778e55e4aea26d753a75048706f3a6b6a19db2cb8a7131d41df3a03d82f
MD5 92f18e78c7525c49da334757c0e87489
SHA1 2a596456c95a1e061c240bdd6ac47918049967de
SHA512 dd94df50f75a6696d4e859676c5125875bdad41c0f98d1de517fe3e7c53da475d94bca78e8734e897388cc5b4d7479bbf6ea26d8731893963ed3dbf8b92d183a
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.dll
Size 396B
SHA256 9695f6865d0d04a185063a45aa26fb9a3834c499944cd6a249911fc429a3401c
MD5 ed7dd8f35b92c433ccfe87aadf2bb72b
SHA1 bb17572461c8072cc00680560996eae88921acf3
SHA512 d9caf75381d2ef2bc9fcb8bbc8aaf47e1f617d7966f7b5603c81f167254f1b2aa9ea5b5947262c0dad97bea285771b20855e0121a60f8320bcc584ca95501c40
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.dll
Size 564B
SHA256 d63455603f1fd6f1c96b7580da0c8e629679f50cd9617fa9e615702ec57d4d85
MD5 4c70e81095b996930561ed48e0fb87f9
SHA1 e0f0dd836e9b5b4edc38c757e9ff3fa9f25adb87
SHA512 014557cdcef148f1bcfed1079dafbeb78bfd0db694bffd7c49da3fd9a8e6d7a5dafe66c82d7080f59322186f641b4f79a39e7937c6edcbfdfd20acc76e0e7989
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.dll
Size 396B
SHA256 cf42eb15205d589578e3a5b7487c250abc50c7b981c57f85023a64126288a10d
MD5 a0185500feb98ff49222556bc0c8bbe4
SHA1 3ffea67927cedd891429cce19ef321678d655a6c
SHA512 bb44593cf1adf0384c72b4409b771d235ebb1b2d3ae56b690bc63ea972c043c75dcf2c014dff5b96ce34acf33bdb52262fabbedca60512e58b2de1ba39914d35
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.dll
Size 564B
SHA256 5e1bc8ebf22c0d9874bd15c0c71720485983ac74f66cca68f85ed47e2c2cc7bc
MD5 5fbf0f3f4d7254eb009ac90e5c7574b3
SHA1 6029900eac11c9c184e1511345b70988c14181b9
SHA512 5fc26f31f07b0b9bfc65cedaa375e1731beb6fb9e6b8901479dc9600ffef6f8bd0ab956e724b8a65cd992deb8ba32299d3faed5b19a1fed087cb11f821f8355e
MD5 SHA1 SHA512

Submit Download

icons.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.dll
Size 7KB
SHA256 4187ab98837140341e456fdc0ccb66f20b4b7797732ca620af10c47bbf85727c
MD5 089f8a405e9fe0d686aa603e4f9d0a80
SHA1 a85a5ba4fa2151edd0d3a5eac79b18e40bd7c909
SHA512 a2d3619d3b6370e319f27dae82a32473e508bd352e2eeb4454511cd29e337ddec50fc906af6148c02ff42d05f0c0933f0402376f839482548d14094fe8474350
SSDEEP 192:Ct65wlVJmMJ3biBsF7rRlqajO4CNgvSDfaWNMH4wqQKM1avjv:Ct3rJ7RbiMqPBDiEiTJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.dll
Size 7KB
SHA256 cf9a92569389e35fee3a1654c571009c12bb1c5c2cb19e13a0f65ea6c4d0ab07
MD5 7079ceda5868b5c2fb9aa383a95404af
SHA1 bc889ee8d3bcb99eb594b41f41bc5e17bd3e1e38
SHA512 53beeac4cdee065ba5516d78672ee368d18f60822aed12e9512cbdd53326060875825f4aa66cb852e8640a789270a74012863fdeecd6808c1321b0377fffd4ec
SSDEEP 192:/k4l5dllpX7tOQWo4YtNk3wBR6n2w6Wrme3lzoNjWWgR//85ZC3:RTlxnlk6wJSElcNjWWgBqZC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.dll
Size 15KB
SHA256 8839be753a7d7ded9f0c153fa60e163f1070d7da9ca6bb3621add90cc47367b2
MD5 aec4c00251904757b996dc42f13d0363
SHA1 98e252d19e1de5407128ba16943ef3ae0b8ecff1
SHA512 931af73a9bb9d6274b056d6eaa6ce1a252dc8713471c287621e09d9c66251b8e319ffbda0149529d0cb326996794a92d2d80bb108728f6cb3c49b15ebcef4a41
SSDEEP 384:ScfG6db+KTpmH76qHEKhyz3PRu0kbXY/voVefgdzHufG:NtdbnpUOqkK+PM7bXYkWgxD
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.dll
Size 8KB
SHA256 cf897e5f770f989f75554dbce7e39c5e105043a072f6e1a37a992dedef568cc4
MD5 13ae803dbeff260d27b812478dd68a86
SHA1 535921d3e9ba107825cae0a538387d60c72dc6af
SHA512 a1f7174a881265bac6589ff2cdf5d148efb2b04db4cb4745908a1aaa96c2e6be6372ec22c7d6dab3f69c942ef2ab9a5e221a48899456314ac169876f20167adf
SSDEEP 192:5+HMI8JiuQemKDwmgbviH+bX8LWCuvwp59hSFhWM+M:5+sI3uQeBDjgbvELWpvwT+FQM+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.dll
Size 17KB
SHA256 1e8a698a0743481bea8cd9df690afeb8b471c294940ef4651a97d0ea1ca22079
MD5 1328c29d9cb378c89adccf1db9a10f7c
SHA1 b3b8d8765ce1336a373cdd5650961d94ce71bbb6
SHA512 a953cdf9b390544f11a1776b390b27b203592931982280fb5026d2b29a91f187fa85aef75d35edee4ab2a53efdc33eca0c9e3ee548dab3239e3dcf1e1408a562
SSDEEP 384:aVP9k3gIgH1O9smISQvNByJSEBK+9G3496vQvP+eNf8fHQJdAaRoi:aVC3gI0Ou1SQvN2XBDU3pQnZXJDoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.dll
Size 188B
SHA256 14f82f9b8dcafcf38097265fdef965cf90567b5c8ddb98de89e737f3dba56fc9
MD5 956ddb334b56fad2ce04613a05da9832
SHA1 32b56c3409ec0816b01f557d17af8e806d1ac04c
SHA512 1f52e566ec93824e15c7b75919955529d87288e2f5b8da902000fceaa8978b840a30c4bc23dcb49ebec4a05ef85f3163b75e0397742784dc5b51af1ce352867e
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.dll
Size 716B
SHA256 3a25320ce4043f34bb2f24eee472420fd76ba69815a724a020319c8a44ea8cdf
MD5 8e10c5c4318277228179f015000787c9
SHA1 4a5805a17fa8f6c6d48d3896b393a56820abc9f7
SHA512 aeb89bc81516321329c6613e9d2bc9d0e6ec1eded3a90b24c911b583f7be482d453001f0971eafb77ff5d14d7f93cd13908e70488b0cb6dc4bf4f6ab32f2e9b8
MD5 SHA1 SHA512

Submit Download

illustrations.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.dll
Size 8KB
SHA256 6dd08340a7e51376bfbce4f10f68f4cd1beae8d01e35dbd8353af9a026b4c1ec
MD5 30b79600c59d4456acd4b72a31e98b4f
SHA1 1f9cb0149ab2de866df7aad65559fcc48e68e9b9
SHA512 54166d4be6ef7dd65409bacd95418fc15b0cd7fff2437de2825d26997260b3051f9bdbba27fc88ebf1ce7746c504f8da1fca19b9fa5a484dd553c379e4510d98
SSDEEP 192:GlWMRoO2GvAIWL812nLKgO8fHMaV1NhwvgAFh+FxqG9dyFR1:GQsoO2SAIWLWKLK0HvafFIFxtyFR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.dll
Size 19KB
SHA256 bdae1fa3a3b3997eb795db90c096336096fc433484c6da693a651f00224f9b8f
MD5 1281c3d783a72ef6e6aeaeaa82769c98
SHA1 9db59b9ae008f2c3d8438160d24f11cf794ac80b
SHA512 aec4ac2533c5eff2198d7fa72d5bb539935553ab66556bc3abbb2eac826e96a0671a4bc43e2a3a84add40fcba6d6b8ed9e3a9832e0ee37638f39b5a916d4eff5
SSDEEP 384:vo/nS4mI0HG0DKnLJqRR88bqmvQ//xhoYswSRW6HPPta:vr4mpRDKnLJqRR83H//xWqSRW6HPPta
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.dll
Size 836B
SHA256 97c34d073ef80b57c1d297fa08c0f615ce23da241ecdff90f9d575a260ff3088
MD5 c1f2d5419acc450d54a718290e68a35a
SHA1 9f51291a8a669f680e7eae6702381cc6e4d92db7
SHA512 25209bd25d683e2903a2edb62105140a31cb2c1b6173523d25c6594b17f3d37d599c7b2b068fcf390143916ca8db47d1d46ba05e52e54ade2b6d9372b8f3521b
MD5 SHA1 SHA512

Submit Download

ui-strings.js.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.dll
Size 1KB
SHA256 9c5ef68d401c37df32af0827f5716627cd1be00d7d3921bae667a528a8823b94
MD5 21836a52b506bcf4c457681b472362ad
SHA1 55d767b159556594044fac6c4a933a03afabd922
SHA512 10609efd94fbc42ca3a39b81d7e311a791cb602f3f8f134c4e2bf4d8e4fc14f08614b9a5d8c6b5d27ed681c2d7fa1dab89c2ebec40ae610aa6018cf6afac890b
MD5 SHA1 SHA512

Submit Download

ui-strings.js.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.dll
Size 1KB
SHA256 04b1664941e89ad2b05c22111f29ead243475dbe0a9b4bcc30781bff27182b4b
MD5 5ed9fd93538581c7c79228fc29c76461
SHA1 18611614ff57c7c945062790e586f018ad3462d6
SHA512 c86420008249ca188a8397d670b3243135d6d6503a048af1ec46146064399805e6265712b80e1b86ec6e4478253ed928437794d14914ac64ee4e0e66b59dd775
MD5 SHA1 SHA512

Submit Download

main.css.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.dll
Size 812B
SHA256 611cd64d82aa901dd8dc5bec8f5fc7804d3bed3d200dca846c3c71669b7de468
MD5 d028e769c26c7b7b5efb236c76aa6f66
SHA1 d1d59eae2f3fd4aaf3935e02e9eda039dc32724f
SHA512 cbab1db91de07904e70de746d35b7f8181f2c8b031011de65c752b4f39036b27720b448265fdc41947d687df90ea303e0d9cd15ef2e63129d08d46592e054d9c
MD5 SHA1 SHA512

Submit Download

bun.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.dll
Size 2KB
SHA256 0ccab6ec5bf325df32d241549ea358bd5cb99792f69f0af9ba2355b0a50f4db0
MD5 356482fd2ee2a34fbb0701827e196080
SHA1 9465d17beb3dfa766504feec605de7eacb183530
SHA512 df321624f6df5370de502333a2c688172b2eb60543ae2babc6887ef20ded7e8addde88427cb505f25cc7049466dc75e0b639b8486b32de357b3af11e1c94344f
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.dll
Size 2KB
SHA256 5cd550f2400f1e1e47d49774d7f0d63512b48ed0bb92f00fbe84fb359bf67d6e
MD5 03cf78bff4fa9c55a808dad76ced92fe
SHA1 6460d33f2ab72958574ebff6c2e036bbf688d4f9
SHA512 1ab4371a385808037284da898ae5453470632c611e6d718fcfc9b7d5b3a1a1ac7bbf2d0106f7aebbac87a7116fd8c8e93838609b6fa0063d5820b89a252796da
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.dll
Size 4KB
SHA256 81c83ac3f8f32ae80406ee725e827981aa3b4f89221d214b8f345578d9734db5
MD5 4715ba252fb35ea85a277e8f68682969
SHA1 a67911c92d61f11bc65f5a824c28b6a6f5977987
SHA512 a6ad019c334087a44eff5623fe5db275679724a0bb106173bf218f4a818528278495e11a1ea3cb7930f82d685e97d63529b62ff742c63127de870b9a1462ff9b
SSDEEP 96:eDr5PwIOZR9ayUeWifwx8nanwJ4ugUebQlZeO7xBrqUHq5JPf22nf:eDrJ9u9qeWi4uagiQlZD19K5VfB
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.dll
Size 300B
SHA256 20a9ec67620ad3794ed4660566790914e745e3bf5ce186f6809da0042864cbfe
MD5 f98fe68ec4d9958e9ba79f655fed2662
SHA1 9d8b8efe2b9731a520f30423885096e2d449b6b2
SHA512 979cb2595d1c165bc375fd34c3e7745163f1dd794944b80685c7c6f9920a71944a778a9347b23a9852c4f14401ee8cf4e5fa639da7dc0e78f87fee5266b4379e
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.dll
Size 396B
SHA256 45104c84245e536b17a968505852db16e633cb8bf1d4d56543722c06f39931b7
MD5 c946ad2c8b1cf5fb04335d18aaf1a00c
SHA1 2d2fab582a84d7d59eff3c5252a19298c8a8c357
SHA512 8be0af19a2068563641f78429cfed820c42a0787ad3a2c83c8050336decd220a6be83a19191d7c89376817074e1cbc0d84dd724ee2fcdbb43b6579c33ca5a9e4
MD5 SHA1 SHA512

Submit Download

nub.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.dll
Size 1012B
SHA256 899ddd312cf66b9d59e703155879205ab0d3a9bba9538c9dea771b6a0a14fc6a
MD5 06eb326d37259427aada0fb76e44f5b4
SHA1 b7705d00f292102f5cd56c5811c964db39a207b5
SHA512 987f99c713338285083e702b5a8fa83b30df195ddafb58e9b1650f1e68acd5a740b351a81a6201414e9480473eced12ee88c6c3ee7fc2cccbde977c2f6cb6fb1
MD5 SHA1 SHA512

Submit Download

share_icons.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.dll
Size 1KB
SHA256 20e30b7f2b48e5ebfe67ae78bc10097174377372850b5e5840d0b581b0d18438
MD5 9208faae2f17b89a4db857174222e3fb
SHA1 0a7eb77da15ad387ee86b650a86ad7cbe4d2d767
SHA512 69b6dcaa25a2057023fa26f4801ff62fbfeafe2f19cc37bd6ff64f929d7d79c60c567705529d9740e59da4f3af417975de398abc393b1218e0808bcce821498f
MD5 SHA1 SHA512

Submit Download

share_icons2x.png.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.dll
Size 2KB
SHA256 dec8857dc957345f3d6af75db26665ae513d8fb90602193301944355bed9906c
MD5 b180dd2e7c0f822e3812c80268dba4a3
SHA1 fc5e3810dc1d5d42d01c55eaf98b763e72e48f08
SHA512 df63c0ebb0ad73f6f4eaed5281190318afe10d46e35ac568936caf3fc140457fe5857e78cdfffae2a08a1bdb54da67bb7ab645052502a1da36b77b45e0d41891
MD5 SHA1 SHA512

Submit Download

ui-strings.js.dll

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.dll
Size 852B
SHA256 f38823517312b6d86cfa3cfeda916bd1bbca95ab4510efbdf3c5ec4021b40c98
MD5 f8f3d5f661b2a122b1a91c06e75b0fb8
SHA1 c0aca05164c2a0702426a5ef0b97563e3be314e1
SHA512 16dc8d5d9452e5d74c117e2f3f291a9430ac70133de93a67f03b86d320c1d29ba6e1cc1b6c37586b783a2e38e5ece4a9df6ca31a3e26fedbd9928a3607939f7e
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_US_POSIX.txt.dll

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.dll
Size 32KB
SHA256 f7da3a30d55743fca0843e2d458eb1ee33bd6edd83e80d3aedbae40b28b3cd7b
MD5 15dcf5b2f7a40db6d17d584d47ec4f93
SHA1 663e7a5e1abb6b3d86e7d809fd64500399c8457e
SHA512 9ae980f599288c071eb5e24687e18fa492e38f824e1e4b18c09ff5bdfcbce0492f5ee4f5e4d896d550393cb76c3810ae85b6639ae2e187d937f41f851e0be7f8
SSDEEP 384:2zUKExm6GISL7naWMPiFherpp8k+1/fBH0pqnFQNKC1lyxd7tKBy+hjdrJm3/TqR:wRcSLAiOqDwz5hRO/C1ris
MD5 SHA1 SHA512 SSDEEP

Submit Download

Example1.Diagnostics.Tests.ps1.dll

Path C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\Example1.Diagnostics.Tests.ps1.dll
Size 252B
SHA256 decb0da1bdead0833f54dc32548f932cb810e9c03d8fb3d3dc2104a1096a9a93
MD5 6ae5d5d444efa1bccbf1d4a26e521d25
SHA1 05ca5f093d2cf1b2a37f767837faf07f5dd28df3
SHA512 128ed9480f367479f3f0251cea8455b6510151b5c6f2cdc0630604654fb41965342370dcf1882ee2bb1b7be5fbab692ec70b3d23f1bb5eb2d2d41cacc436308a
MD5 SHA1 SHA512

Submit Download

invalid32x32.gif.dll

Path C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.dll
Size 164B
SHA256 93bd0ca7b4192d0aa23cbaf8c019ee599fed046f4781dd3745f43a3a971071ef
MD5 bf25fec443e3f22a36e59717313949ad
SHA1 d3bc00c464a69cf6a1b63fd1528eb0e0403585d7
SHA512 92792492c55208a2da0d1e69ef0a90ba9fb2821563aae52265193d8e6951c2feca511418f947769e5287a9b13835c6d8c853c330decc57b5a6658b5d83395768
MD5 SHA1 SHA512

Submit Download

POWERPNT_F_COL.HXK.dll

Path C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.dll
Size 124B
SHA256 3a04a41bc8d6af9206264dbd7e2623400a7daf0b295112a8f671bd8db405c707
MD5 d7de1f025c9417fa8547ebce629b4dca
SHA1 619fddd06392afea68d07c40c1493b8e9ab973e8
SHA512 d44991c96d4e6885576172a064f8af4fc1621f3dd28d0fe46be808535b1130c67fd14f614844f7a76bb5833cdbde8a9780042fff81ae2ceef250eb6283aee1e6
MD5 SHA1 SHA512

Submit Download

POWERPNT_K_COL.HXK.dll

Path C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.dll
Size 124B
SHA256 68b81cd28e8596da11369b47051974a0c21acb56f1e7a344192cf7a3d98b633d
MD5 ba009ce587e0b6abc48cae16ea51f989
SHA1 88093fd2317d8f11b176fb254e18180a9aaba039
SHA512 f4e6b3e23f85198ee9a3bfe5a4b2ad1677ab67157de462acb9f2dbccad45d2f5106019954da30d53756c2ab60b7f11cb433c3f68487cf2969b3a6ad2e67ffcea
MD5 SHA1 SHA512

Submit Download

OWSHLP10.CHM.dll

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OWSHLP10.CHM.dll
Size 4B
SHA256 a7c046c8702d146d7b68df28480248d3672334bca92b0e3a7606994570b6b027
MD5 69b99168d68638bfb0f888187dfa2ca8
SHA1 a4fa8ee7a398095fc0458aeddebd4aa0cb087eb8
SHA512 1f577a8065be9beac40fc94fd598fdb1a3b3a0ff0199306c7bd1e4bc06070b098d98839d1ccbc67636992cac3cea269f61e3de34302590170a65d5b06a99ead8
MD5 SHA1 SHA512

Submit Download

CURRENT.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.dll
Size 28B
SHA256 36c4e62163a20880749b02bacdd9ae9a31ba5d62f9bd62b9f53afd553335a2b5
MD5 d9716d5e585ed4743d0e3834735bede0
SHA1 f3e7ddd839102babf1dfb7a877a12e9d61a75d68
SHA512 b6fff31e681ff7b5b1431967024039290e385500ef5936c487b32eeed4eb34ef434c247e0cf2dada68870376903b40634ed209f01433d85ddf37b967f94439e6
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.dll
Size 52B
SHA256 e835203e386b398f32f72c008215404f6ffa1bac82876427fb4c99fdf5ca57bb
MD5 dcf7da904fc1b62698405565d71dfe8f
SHA1 2232aae30a5b0c0f9317c25be3048e83ad710d0f
SHA512 5a0c64284bdeddebf5a0e25a02f8dd3e390d012b043a83458134c0add9813be0be8b1de4d13f87cfda2190b720c25d9ba19cf23e8074e509e0241df5d563f74c
MD5 SHA1 SHA512

Submit Download

index.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index.dll
Size 36B
SHA256 de9d2fddb1458b2436b41b0f73e03a622d76620b09f82681888a54ba3b45e909
MD5 8b1de4b17d7ec91bd12c4fa99d00d543
SHA1 faf54aafa326a395b1e6f225d15cecebb496a7a5
SHA512 5035f9a08d1090277a67a681f8a8b23a6ea752fc6f5073ff3eb1f956317f86edc203c1bd8b26a6f9fbb48a0f5dc9aa2c96cf2b1418617594f536253c106b92a9
MD5 SHA1 SHA512

Submit Download

data_0.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0.dll
Size 8KB
SHA256 db8bf2431615acfda796f75b0197ffc59c5abf3abb1136df2558632148bef4cb
MD5 fb4fb469bebd7160f81f331127a1dde8
SHA1 2d76423ff01f27e2d96021ca7622310a3b4e267b
SHA512 01a0c43e81c443d018ed67642d5365c5b17711b89591f47d0e9bcf8c2377afcc304c7775d7e49d21d486ae9725fbbb82ee38a0ebe3104b37a0cd90c99240ad7e
SSDEEP 6:oNGVQBJVRgggggggggggggggggggggggggggggggggggggggggggggggggggggga:mGVQ/V4
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.dll
Size 264KB
SHA256 0cfae08bb7b631a3f64ee11a2b6f51a4f5acd7ea1013559d43304c9c57daad48
MD5 95fb8fafa54e28eadd0f4891d2356857
SHA1 fe73800e0a4c21dd98a977b1ef494761a1ebce0a
SHA512 1931e9683c3aa9da1ebb06b1ef5678d3eaaee34077f43772b6a4bfe7659df3fcfb520a1e61ee85c412f0fa3df12214c2b06b268c14cf7001ae7530b7f2ee03c6
SSDEEP 6:uYXmqMwggVsZvgggggggggggggggggggggggggggggggggggggggggggggggggg8:uxqjsZDw
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_2.dll
Size 8KB
SHA256 090407b7ab31a3fb30893eae1ba6997121bb3d106b72327e47a58242f59ecf95
MD5 24e19ba0e97fd64e0b7fd5eb78d3dee0
SHA1 8acc3e5e92a5838987af9ac8d24d85dd5cc1b647
SHA512 d6d1467dacd0d4d56562b26a9e65a60ed3c16c181997a987d925f0d866f80b95b6f73f745ede187004454d1d2ae7b629df541c06e951681fc94e1d3dcc211c0d
SSDEEP 6:oNwclN4ggggggggggggggggggggggggggggggggggggggggggggggggggggggggZ:m0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3.dll
Size 8KB
SHA256 3716cf68aeef8f2202ccf6142cea279ebd18787ba5df77700940561530b4c5c1
MD5 6fd30d3bb51a9ff5658ab644bc20ad2e
SHA1 6389314fd40d6eb18970618f4e46069f8c64c7d8
SHA512 927c1f5925d0532e843cdaee570207ef811d0562c2079d87c9354d7c6b1f2a59010a2d3700c8809789b71681acec222fb1740678509b72e20c0830d744b81ea7
SSDEEP 6:oNYXZmVggggggggggggggggggggggggggggggggggggggggggggggggggggggggZ:mYpmH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.dll

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.dll
Size 36KB
SHA256 4842ae350468838920806f56ecf3354a81c62a22f05905739a609006e5fe58d3
MD5 769c7625f4b6561d6cd0dc07cdff2708
SHA1 df2d5a5b39a326610ec358d635f418bee35cc51e
SHA512 dba4bdc19c6681f27c9673c810e9f96e4cf5b335133c54f3d9811b4934c4f0e939641b9c3076407de6ffc3f4eb0e7cf68c5f4425bef18e4cb1dee6a6a2dfbba0
SSDEEP 384:nIIIIIIIIIIIIIIIIn6HI17UyOFIIIIIGIIIIIWd:HOzl
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.dll

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.dll
Size 36KB
SHA256 73c2dfc75f71c14112c31fd92b05013638e13eb8a0cc9024a4b0bff4bfec9c89
MD5 6cf621f0ae8dfa4178443f98af359e23
SHA1 2bfed72faedd7242d6f7bb0c9fc6bbd6f115b774
SHA512 c06e408682a843f1cb948999ac1bd1ee3363b54383820676ad98a4d7630103d9d83c70d8ae7d75f9f267d2172bd5d2fcd4241132999e13cc69b81eec721fe157
SSDEEP 384:++DkJBptUMPFwjZWx9SuS+6/S1Evs6O+oaG09gNxuiic2rMxer:++Dk5tUzZiUuI/SJ6noJQ9iQruu
MD5 SHA1 SHA512 SSDEEP

Submit Download

1451318868ntouromlalnodry--epcr.sqlite-shm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.dll
Size 32KB
SHA256 58f3dc2e7e1f3f3c7a353056910b5484821216747373da43e0f7edeb4136dac0
MD5 f5c82245902a2588f853c280fbbb4eb9
SHA1 b663a231e4d691949518c11d5e16ecdfbbd2f314
SHA512 82ea9adb079bca9adb0ac85fe7a13a562c5916e2411f5a0ade873d6b70e2d040c206e0033430b6c5f5e3e1651fd29b702ad06f50d62e9b073c9ea04d8ab5238a
SSDEEP 6:SCV2lPDkj2u3kjgk8+pQm91PlhvggggggggggggggggggggggggggggggggggggZ:SlVGFCtZTlhR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.dll
Size 48KB
SHA256 5fe750b35364d06545a9a8e5f20bbeb674d392f0e6b266341ac958eb700d6915
MD5 71f136de5052e691eaf034a2af451955
SHA1 9734af5f2cc58ad652d316775e269d9a744ce67c
SHA512 21fc6c46ac65244f10bcfa7c01e4d376eee8e336c6b293f0564dc7038c93c66928807bdb0cea1febc46f95f4a40c3066dc90c874b69aed0f897808369cee9243
SSDEEP 96:x1izFRkUyXE93pAgSKz9ufmLL0d6JUwviXJYXyd99H:x1izZy0QghCmN2Oi5YXi3H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Payment.exe

Path C:\Users\Admin\Desktop\Payment.exe
Size 1.1MB
SHA256 0c9844f11b7b57547891b3cec86bd3468734a990768dd9f7a9a72cf6a908b17a
MD5 9f9bb9ee4952cb514089910e19eac5c4
SHA1 c57f604e8eca50df40df93a6b0c3d65ab8d3b198
SHA512 8661c46618d0f8454a278d6a4e1b85fd9c9656c2e59feb6851087bfcdb53bba5015ce023cf6d0504dc899ae6fbbd4f413b45228eb2c8eb6965912cb32482d14f
SSDEEP 12288:JYxxeoAKNmiZd8v+e3H6RUgL1CNjCwxqGXHaxdX7O3NmQMpuA:JYaxKMiZA+yH6uw1ECvGX6H7O3YpP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Termite.exe

Path C:\Windows\Termite.exe
Size 566KB
SHA256 043308721b7ee6a1a93250a1d013a1a761fef7368c9ab483514c31a1584c86d9
MD5 67f8b2f83aa50da8186f03e69358c160
SHA1 e9010ec5abfab7162ba0caf507d3246f6680bcdc
SHA512 66d5392f7a10a4e1beded35b41e3e4c73fba4a2a9cad4139353c29b7cac04fa9babf9049054eaa4c3475e52dc6854734a75a62480eeb8e5258509a90c7aca6df
SSDEEP 6144:etzgx2GdlblXkmatlBF7MuJGSN4r8jZlIPMTaE+q4Ow9waqgpJOuKWK519CkBOwh:e0nlXkXfBFINSdwPbQvbgyv7O/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4504-1-0x0000000000601000-0x0000000000602000-memory.dmp

Download

memory/4504-181-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4504-0-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-6694-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-941-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-6-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-8271-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-3806-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-1569-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-3390-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-1582-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-9619-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-9621-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-9622-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-9624-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-9625-0x0000000000400000-0x0000000000613000-memory.dmp

Download

memory/4732-9626-0x0000000000400000-0x0000000000613000-memory.dmp

Download