xworm | 31cadbe69cb9aa413846173101ab221115ca248d2154343fe27ecb2190597134

Analysis

max time kernel
210s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TasNET 6.4.2.exe
Size

11.0MB
MD5

98680a096ea18299b58b5edc02c32fe3
SHA1

16a15c4d9cd2d0b06d5a562652674015984a4069
SHA256

31cadbe69cb9aa413846173101ab221115ca248d2154343fe27ecb2190597134
SHA512

712e55650066520045fff13ad0326d871a7d4bc6c68c7e6ee0174259fa7a357ce93bdafb18cfbb682fbd2c0f1d28cdeed883c5c729238576210715b6f4d17e30
SSDEEP

196608:PpBZ9P7gzj9Pjnt8unJQfPngNQJdVilMG9/bpsBJKtJF1yP3hYjsB:fZlcNCunmf4NUE/tYK1yvU

Score

10^/10

xworm discovery execution persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

why-wheel.gl.at.ply.gg:49900

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7921366915:AAEY2hsLmS8SLDWCoThahhj-qRzVY87NnlQ/sendMessage?chat_id=7110244770

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0008000000023c8f-7.dat	family_xworm
behavioral2/memory/1716-18-0x0000000000EF0000-0x0000000000F0A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
5112	powershell.exe
232	powershell.exe
3032	powershell.exe
2600	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TasNET 6.4.2.exeTasNET Service.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	TasNET 6.4.2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	TasNET Service.exe

Drops startup file 2 IoCs

Processes:

TasNET Service.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	TasNET Service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	TasNET Service.exe

Executes dropped EXE 2 IoCs

Processes:

TasNET Service.exeTASNet-6.4.2-win64.exe

pid	Process
1716	TasNET Service.exe
1748	TASNet-6.4.2-win64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TasNET Service.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	TasNET Service.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
12	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

TasNET Service.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	TasNET Service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

TASNet-6.4.2-win64.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASNet-6.4.2-win64.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
2652	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exechrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133774450252565205"	chrome.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeTasNET Service.exemsedge.exemsedge.exeidentity_helper.exechrome.exe

pid	Process
232	powershell.exe
232	powershell.exe
3032	powershell.exe
3032	powershell.exe
2600	powershell.exe
2600	powershell.exe
5112	powershell.exe
5112	powershell.exe
1716	TasNET Service.exe
3680	msedge.exe
3680	msedge.exe
4036	msedge.exe
4036	msedge.exe
3784	identity_helper.exe
3784	identity_helper.exe
4564	chrome.exe
4564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exechrome.exe

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TasNET 6.4.2.exeTasNET Service.exepowershell.exepowershell.exepowershell.exepowershell.exeAUDIODG.EXEchrome.exe

description	pid	Process
Token: SeDebugPrivilege	3672	TasNET 6.4.2.exe
Token: SeDebugPrivilege	1716	TasNET Service.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	1716	TasNET Service.exe
Token: 33	4556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4556	AUDIODG.EXE
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe
Token: SeCreatePagefilePrivilege	4564	chrome.exe
Token: SeShutdownPrivilege	4564	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

msedge.exechrome.exe

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

msedge.exechrome.exe

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

TASNet-6.4.2-win64.exeTasNET Service.exe

pid	Process
1748	TASNet-6.4.2-win64.exe
1748	TASNet-6.4.2-win64.exe
1716	TasNET Service.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TasNET 6.4.2.execmd.exeTasNET Service.exemsedge.exe

description	pid	Process	procid_target
PID 3672 wrote to memory of 1716	3672	TasNET 6.4.2.exe	84
PID 3672 wrote to memory of 1716	3672	TasNET 6.4.2.exe	84
PID 3672 wrote to memory of 1748	3672	TasNET 6.4.2.exe	85
PID 3672 wrote to memory of 1748	3672	TasNET 6.4.2.exe	85
PID 3672 wrote to memory of 1748	3672	TasNET 6.4.2.exe	85
PID 3672 wrote to memory of 3664	3672	TasNET 6.4.2.exe	86
PID 3672 wrote to memory of 3664	3672	TasNET 6.4.2.exe	86
PID 3664 wrote to memory of 2652	3664	cmd.exe	88
PID 3664 wrote to memory of 2652	3664	cmd.exe	88
PID 1716 wrote to memory of 232	1716	TasNET Service.exe	90
PID 1716 wrote to memory of 232	1716	TasNET Service.exe	90
PID 1716 wrote to memory of 3032	1716	TasNET Service.exe	92
PID 1716 wrote to memory of 3032	1716	TasNET Service.exe	92
PID 1716 wrote to memory of 2600	1716	TasNET Service.exe	94
PID 1716 wrote to memory of 2600	1716	TasNET Service.exe	94
PID 1716 wrote to memory of 5112	1716	TasNET Service.exe	96
PID 1716 wrote to memory of 5112	1716	TasNET Service.exe	96
PID 1716 wrote to memory of 4036	1716	TasNET Service.exe	116
PID 1716 wrote to memory of 4036	1716	TasNET Service.exe	116
PID 4036 wrote to memory of 3964	4036	msedge.exe	117
PID 4036 wrote to memory of 3964	4036	msedge.exe	117
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 1588	4036	msedge.exe	118
PID 4036 wrote to memory of 3680	4036	msedge.exe	119
PID 4036 wrote to memory of 3680	4036	msedge.exe	119
PID 4036 wrote to memory of 4988	4036	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\TasNET 6.4.2.exe
"C:\Users\Admin\AppData\Local\Temp\TasNET 6.4.2.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Roaming\TasNET Service.exe
  "C:\Users\Admin\AppData\Roaming\TasNET Service.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\TasNET Service.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'TasNET Service.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0cc946f8,0x7ffa0cc94708,0x7ffa0cc94718
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5996118093226206384,5208184709029607981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:1408
- C:\Users\Admin\AppData\Local\Temp\TASNet-6.4.2-win64.exe
  "C:\Users\Admin\AppData\Local\Temp\TASNet-6.4.2-win64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8D2C.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x2b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0635cc40,0x7ffa0635cc4c,0x7ffa0635cc58
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3732,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,12305162221751852832,16153150520539805196,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:5840

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c13f8cf39edc71d51abea30359d1d814

SHA1
a942fc133cad88fd90a72406eb8f0d465c1214e6

SHA256
164d6468105d7961517f9a6a2d6d0cd47218d91f12fd4137f5e4f32a1ba4e737

SHA512
6ac0501c66456886a13b3f27074af04161b83d1867c0194e082c164f2e94af9285f955f9d5fa4cbe32e9d6f6844074c137f14023239c339083c7c8c554bac5d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
894fea552f3094ad85765671c47f1fb2

SHA1
6509eed457c5638832c552d6f0048c1dd442e352

SHA256
d6b1cd6acec87a91f5f92ee5a9758bd94678ecef667f24d529d2da9941ec0510

SHA512
3affc3c011ef0fcd89c56a20f2b4e1075c15756df36abb8df01c2476dab3d37bf6895c12e3f5cf17c0b0c5fd003e5aeb102a587359ab0223e6f3a12b7aab4961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c2394ed3f36ea34e862c7ef013ac2bad

SHA1
5061f371d7432998655c9af10a3b26b4e1c92b72

SHA256
fe92b6dd00e34a698a9475cefdfc112053658d9db0dbfd9116adfec9cfbcaf1a

SHA512
e94cc0da5c07a55af1fc3c63fac1c7446b8da9acc75a8e324d57a3b4dcfba9a1f3b562aed983468eedbf4897f01ea1c539ff9d27a9f999e8275d6e6a015e8479

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6fb05f92477fa7ef08f982cdeb97a5de

SHA1
4477fd6a5496ef1b4ed0cf5563b72bd056d0c4ca

SHA256
3a4827de8283e9357b62214da0e57f2afd18f35640b9614e1c1b51203077bac9

SHA512
ce95c2e95a7a895f830d2cf48267bd1bf7af5c57e3bbc7ed5aea9febb6b8cd3e29b319c71a9a7899fce42307865aefd6218b24f691da1f93fa8f809d30947df4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
5cdec3dc12d5c71baa22661e699d1669

SHA1
94cfafbb82f8310acc305d511c924d0fb218c1a9

SHA256
366007770ae24d102272cfd35f9caca927380fd62a6fca1082f2400d1be77991

SHA512
7135917ee8f52eac500a5a19374c23642fda8846695a8a266a89d8d72ef72221a82083ea588f978bbc9f2df1e6158e851d818baf0205aa5b63f245307b91df02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
49027adce7f9f1afb608441ff5eb3f8b

SHA1
12fda72ed8a1c757c0ba82ca6fd0065c62a09782

SHA256
dc97d4e12e8a4e3d3ec6d2decdba82a9d31a79754f1a04fd4bf37ec4a03e5cf5

SHA512
476444cfa3ef80e6b61d5ab2189f0ece91b732dd10b7ffd8fd36299c3e5cbd94d1d2983033d48014a3c363354e4d12a26368d1560e059188aeb93d147145357e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ded594fac3d09b2488533d56cb324da5

SHA1
2f6f89d69c81036c5d5d81c46217bd2424b32787

SHA256
da203eac74a3055b2dd9d204e97c9032a54d26acc009518322085512188e3e87

SHA512
8bbb9043a65602ca51c74c7249b4369aeed06ee289646818fdacd1d60f9ea0db5eb57cce7a424f3e2925b7ac3b470e323328083426986664dfba03861774f456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
604a83e2ac51b4d46072fff2f7a4f162

SHA1
91e0c55724570b2396f3f63da915746359efd641

SHA256
18d485d47b6aaf2e6dd8870e930b98bba8e65a5713322125d042cb3232f82c9e

SHA512
58d1c0eba5fde5b2d8ec0dd37c0c863477f3c286c62b12a33f8e041bb99b38be4821421ed756a3109fcf6fd90cd44a70c8ea90fef6a5df46b46b421af7276cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad079abbf419bf4defcd11545e4ae15a

SHA1
11ce801d1f83efd1980ef2a2bb56e9c632b4e5cb

SHA256
753c1cce4c98f032c5e2f31e17c6c41e29e2c0b7a74407874fa72b1a8f5c651d

SHA512
8947d0f665b8d82834d2ae68f11f92740d3fbf8f053f915a4f7d3a2472c8748e197e9e14394bf554f166e6950cd955965149b71700a9363b617070aa43bb281d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9d547d71caaf7d5879183fcf5cea376d

SHA1
4e86764370bd85832ec167601a21e1b01bad4a76

SHA256
a2873536cbc08f27158e920841ec727cbaca43d383fb39dd04978f3653f6aff7

SHA512
a593994cdf757c3cede954da142848ac3b6ad55bd3557dcf48436e82fcc748efac4e361584cb3d5fccb035640eaaa00b80afa65efa76397d7e333a02403e4814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c1b0a9f26c3e1786191e94e419f1fbf9

SHA1
7f3492f4ec2d93e164f43fe2606b53edcffd8926

SHA256
796649641966f606d7217bb94c5c0a6194eef518815dacc86feacdd78d3c1113

SHA512
fa0290d77372c26a2f14cb9b0002c222bc757ce7ad02516b884c59a1108f42eb4c76884f9edb6c7149f7c3fac917eda99b72a3b1d72b7e118a1d5a73cadd15a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3161f4edbc9b963debe22e29658050b

SHA1
45dbf88dadafe5dd1cfee1e987c8a219d3208cdb

SHA256
1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a

SHA512
006ffb8f37d1f77f8ee79b22ffa413819f565d62773c632b70985759572121c6ab4743139d16d885f8c0ff9d0e0b136686741728b3e142ee54aea3bb733dffb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TASNet-6.4.2-win64.exe

Filesize
11.1MB

MD5
21bd4314ff1dc491b8caac21c5e92d32

SHA1
1e47badd5445a66906a5f968e6165611cf3348ca

SHA256
907e248770a737cb7692d8d12205e7267ad1e77d241f61bf3762fad1177996e3

SHA512
2a31f87d35b66c9d65804010bde61ca145b7d4ff6806bd4ac0ba591a1c7ed1ede134e147d088d800ac1e60756656c3f2774292ae9b00df3f9e989768622180e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f0ve24g3.szx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8D2C.tmp.bat

Filesize
164B

MD5
04097cd357cdf2d5f4c44b5e3780bb61

SHA1
5032ea6fb6c43e4974effaf588c4a761832c890b

SHA256
29def45966d4e59a0696541580a35bc2e1287e84904b9e66579179645ac08504

SHA512
27eef5098d53b07061e073090f4b81822cf4d1b0e24cc968202f36dff5e8746422656e3b41a34c4d5df4bc04cebe32c8fcbe6a4b28486b39951b5c9b651727c5

Download Submit
C:\Users\Admin\AppData\Roaming\TasNET Service.exe

Filesize
81KB

MD5
3f8a4afb12f13712ee2f75400873c734

SHA1
af63280999063b26b74b3f7c4b2458e85bbdeaf5

SHA256
5d3b21cf3e15db8c42e8d57da53d00a32b6870fb3b92ac47577666c21abfdf6e

SHA512
0b66eec5c816b2af09ec12ae413922d9547833a2bb9bfdf9d2c032f2ead725f35032a80037429c5d5d3c7f2cc83b6ef5c61ef359aab00c1e2e446389d8bb6608

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
3df3721021dea8f5f826e23a43a8601b

SHA1
09eabe196e4d7c376b444d4f50bdd751fbd898ce

SHA256
a189d413dddaa0a36e42ae92dbd82d8ae39351466b3749eef23c31a0c167cc03

SHA512
80f5fa2f54014a7cb59e9b74153073403d13a03dacdd95e8ffde622ce9ddc34ca87301d3311b9ec9b5022e38801c601e0d192b737352e0e8a2454d6845ad202e

Download Submit
\??\pipe\LOCAL\crashpad_4036_XQJESNEBRBMOBVRH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/232-31-0x0000020BC2B90000-0x0000020BC2BB2000-memory.dmp

Filesize
136KB

Download
memory/1716-30-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/1716-85-0x000000001C740000-0x000000001C74C000-memory.dmp

Filesize
48KB

Download
memory/1716-84-0x000000001C070000-0x000000001C0FE000-memory.dmp

Filesize
568KB

Download
memory/1716-83-0x00000000016D0000-0x00000000016DA000-memory.dmp

Filesize
40KB

Download
memory/1716-81-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/1716-19-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/1716-18-0x0000000000EF0000-0x0000000000F0A000-memory.dmp

Filesize
104KB

Download
memory/1716-386-0x000000001C8C0000-0x000000001C8CC000-memory.dmp

Filesize
48KB

Download
memory/3672-0-0x00007FFA102C3000-0x00007FFA102C5000-memory.dmp

Filesize
8KB

Download
memory/3672-28-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/3672-2-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/3672-1-0x0000000000040000-0x0000000000B40000-memory.dmp

Filesize
11.0MB

Download