06a944cd076179354260f34168bdfa8db9b370c96214211434c68442b782c0df

Resubmissions

07-12-2024 23:31

241207-3h4hbavpbl 7

07-12-2024 23:29

241207-3gwfbazme1 3

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoulTaker-Multitool-master.zip
Size

9.8MB
MD5

bc455c573d252f3fea063763d5c6283b
SHA1

cda783ec82d8b8ce8e830f13255abefb41ab8350
SHA256

06a944cd076179354260f34168bdfa8db9b370c96214211434c68442b782c0df
SHA512

e5dc03d2f39532f047b5c4c8b92ef7d87c79d93584659bc0ee3384dbd5d111e99a6b59649b31d026b7fe995703959435a9abf6731444dcc0f0f3b9aba84dabc1
SSDEEP

196608:3H5dvi57uQMlLuvpM67zSFbTxIymwiIwOHkz7wAQPaO9uGdVmDNTC:JoAQMduvpM6KQydtwaY7wNXrYDNW

Score

7^/10

paypal discovery phishing

Malware Config

Signatures

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x00020000000226df-45.dat	net_reactor
behavioral2/memory/1556-53-0x0000000000BE0000-0x0000000000DFE000-memory.dmp	net_reactor

Executes dropped EXE 4 IoCs

pid	Process
4224	Dox_Tool_V2.exe
1556	iplookup.exe
2476	putty.exe
1312	pScan.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	ip-api.com

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dox_Tool_V2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iplookup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5032	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
792	msedge.exe
792	msedge.exe
2968	msedge.exe
2968	msedge.exe
1460	identity_helper.exe
1460	identity_helper.exe
4416	7zFM.exe
4416	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4416	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	4416	7zFM.exe
Token: 35	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeDebugPrivilege	4224	Dox_Tool_V2.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeDebugPrivilege	1556	iplookup.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
4416	7zFM.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 636	4416	7zFM.exe	97
PID 4416 wrote to memory of 636	4416	7zFM.exe	97
PID 4416 wrote to memory of 5052	4416	7zFM.exe	101
PID 4416 wrote to memory of 5052	4416	7zFM.exe	101
PID 5052 wrote to memory of 3608	5052	cmd.exe	105
PID 5052 wrote to memory of 3608	5052	cmd.exe	105
PID 4416 wrote to memory of 4224	4416	7zFM.exe	107
PID 4416 wrote to memory of 4224	4416	7zFM.exe	107
PID 4416 wrote to memory of 4224	4416	7zFM.exe	107
PID 4416 wrote to memory of 1556	4416	7zFM.exe	109
PID 4416 wrote to memory of 1556	4416	7zFM.exe	109
PID 4416 wrote to memory of 1556	4416	7zFM.exe	109
PID 4416 wrote to memory of 2476	4416	7zFM.exe	111
PID 4416 wrote to memory of 2476	4416	7zFM.exe	111
PID 4416 wrote to memory of 5032	4416	7zFM.exe	112
PID 4416 wrote to memory of 5032	4416	7zFM.exe	112
PID 4416 wrote to memory of 1312	4416	7zFM.exe	114
PID 4416 wrote to memory of 1312	4416	7zFM.exe	114
PID 1312 wrote to memory of 468	1312	pScan.exe	116
PID 1312 wrote to memory of 468	1312	pScan.exe	116
PID 4416 wrote to memory of 2968	4416	7zFM.exe	117
PID 4416 wrote to memory of 2968	4416	7zFM.exe	117
PID 2968 wrote to memory of 3356	2968	msedge.exe	118
PID 2968 wrote to memory of 3356	2968	msedge.exe	118
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119
PID 2968 wrote to memory of 376	2968	msedge.exe	119

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SoulTaker-Multitool-master.zip"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO041929F7\SoulTaker PSWD.txt
  2⤵
  PID:636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0416AFB7\RUNTHIS.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\mode.com
    mode 160,50
    3⤵
    PID:3608
- C:\Users\Admin\AppData\Local\Temp\7zO04167968\Dox_Tool_V2.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO04167968\Dox_Tool_V2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- C:\Users\Admin\AppData\Local\Temp\7zO0411AC98\iplookup.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0411AC98\iplookup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\7zO041F00B8\putty.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO041F00B8\putty.exe"
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0419CA59\Pinger.bat" "
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\7zO0415E969\pScan.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0415E969\pScan.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title pScan Developed by: @the.red.team
    3⤵
    PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7zO04159019\login.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc372a46f8,0x7ffc372a4708,0x7ffc372a4718
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14102742719368227990,9439046088825475350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
365d4c0e6fb2246e2cfc9c6b1ceb9e6c

SHA1
c0b676078d1d40af526648b1dae869c6e9ada4e8

SHA256
e6118384034604662a8c6274902c66ec21c395c86aa3f02cc6db42bbeec6dca9

SHA512
ee516d1dcb07c070bf412c7f7775979e71d054a8a67745f25fea978e5087278efd5867f8792866ef1ac3120623e9e74418b7807d807f47104f5e812fad79e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
400B

MD5
392658e81b26bdff7ea5796ed8e30862

SHA1
25cb570eedc0a71e476a319641a01e381b109ee2

SHA256
a431dc03b5454aeee73d9f6944f8a9faaeb2d25012dc2b9913ec941654f32334

SHA512
395106cf1130836e106ade5905f21247053a1245dfb06b487d6142c40248c1dc48d44a02c6ea05402c0e818c0f5d8986d07d0e6d765a19684a3e000852803ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73d06d649dd1fca00de3adf246425d4e

SHA1
bf306b0d412d5a014b0bbe13b03bb98805b8be31

SHA256
5df54db2aa34fcac067dd1287f0e7df6bd6014474115f30ad8cc67d442f775fc

SHA512
bb27d0fc019b4d0d7aaa80844746deb784736c2df703750c291c3fa3d0fa4721fc875dd45d59bf981eac4f163de06a07a678e892848e4835b28cfb76ecf031de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7d7502fd0ec47af94c42c02943b2a03

SHA1
900a3ba7064f308b67333c650b037c9b34f96710

SHA256
46658300f862c4a0a4020704cb68ed27680c70253dde1d00757304f272f797e1

SHA512
b24d746b4d09915c2a91e5ae342b5d88d1381161cf7da4f6b25b347033d97f2384126f39203fdfc77d289e795d8c78812f108cf330ec19b9bd004b87783425cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5866842248319e66948d733bdc30ebdf

SHA1
9938b6eae4141d56d5b3815b0d20584b885e1466

SHA256
cd1764b7bc2ec6226706e2c1074a20fb63f5e202821024c48586baa94b0c2adc

SHA512
94a7d938be5a3db338cf4e146dbe77991ecb948b9f88f38267fd2c2ac308d3e39866c112df809bdd9ba553af327a8b9b1595834661de1f912ecf49398393d66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0411AC98\iplookup.exe

Filesize
2.1MB

MD5
cb4903c1c4f23b021905da634c002f04

SHA1
c2ccf3a1e5037c6e540b94a59e2c367ba8cd9090

SHA256
49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76

SHA512
7f632331ba7f2fdd3c76f7f158a1cd6e79be796f2dc9f9149b7a071bb77b35fc4f0c6f189a8179eaf4947533513a3f926c879c50c8cf6cb13abdd424113f48fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO04159019\login.html

Filesize
94KB

MD5
308a17af2172994d51dd806cfe97910e

SHA1
743c512c9d8ae246c35f67e4611b866caccc9302

SHA256
750de8d980931515d7127f23563306335569c8626df09a59335a8eaec2c867eb

SHA512
9a54f8cd5755537593ecf77db79c852b3ecfd59b7e94a80c1863e11f8f0f518468b083c8e18c70a23411ebe40125e8e74b5ab130fc761d11987a92e50b2fbb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0415E969\pScan.exe

Filesize
1.9MB

MD5
03b867083e6c7766c4829cfda776c01c

SHA1
52ce47d754f53e32afb7625b47a4cf4d21efc04c

SHA256
d023f36a47d4d81491c3ffc7192669199441d7388c159f59414b3b5f137c519a

SHA512
c906206f3a79d9921b8addc69e50b8c31b8b4191faa81b608dfce7295f1714a21a593145d2bb9e847a606ae093de26b641f49bcebe83fe2f88b9984d3799ae79

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO04167968\Dox_Tool_V2.exe

Filesize
180KB

MD5
b0424efaadfbf9991e55b397076c8181

SHA1
bcf68986d9f98bf5d76a7eba580eb09be05e6243

SHA256
dfdb90a7d5e41b030bb8bae6f325688ff3d3b3b2da8c554c34e66dad86cebe90

SHA512
54e4cb638c71dd987951619ffb2e1d4f98fab7d75af4c1d39fed30162aece639961863b3caf1ade34f840a02233cf9431d9eb30e76d5a470383392c2fad0bfcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0416AFB7\RUNTHIS.bat

Filesize
3KB

MD5
4a450b7ea9d10017957bee5a2b3d8503

SHA1
7f603a39a898c196ae5c9cfc8292d7cea9d74b8d

SHA256
028c77cd6cbb44372fcb7b37a3739bddc10bbc1f236547753f4a86421af887a8

SHA512
875d0753395831f4987f1c922c9067e56f7e7f65718ac0d244ef9f69b2fde9599c48c7fae2da68ea7f25ddb7b694461913344d221eef57f0031e6242d3f77d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO041929F7\SoulTaker PSWD.txt

Filesize
22B

MD5
72872be602cec07e3f40f992a8e80d8d

SHA1
44cff3a5a14927a664f59a40657599b02aa9fd34

SHA256
8a78a2c57e5be50644bcc5ea3cac673198001319b0b84eba486d1e5a7c2b6e63

SHA512
be0942157e36cd01a211a0f8395d9c6c23bd377df0efb536df35aaeb6c13a1db5285e970968ddabcaa68356b2ac6817e7ee58501412212569727edd5d19b2299

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0419CA59\Pinger.bat

Filesize
2KB

MD5
a209e427375713a8298a64adfb4a1ce4

SHA1
c0a22a93a0833eb622ddc3659706892665795371

SHA256
1867ba1acba1a49485d86e09f4ab577669279087b0018fd0d4bcf4a22a6b161b

SHA512
a362887771bb1eadadca33eea0685fa9a2ca26f783907b2f42f780e0f4ae1c3745311d69b0ec4f95cf6441aeb374428567a1525123079cfa235f419aa9e013c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO041F00B8\putty.exe

Filesize
862KB

MD5
239c6a38de34b2cc26afbc41adf3a11d

SHA1
ff5d4e320e599666a629e1d76638111221ca8ba1

SHA256
b73d6f26808b85c67cc0714d0bd1ead6c0dde47b21ddcf1f76962725d8e3311d

SHA512
bb25a7e88afc1bcb1226442d436f45d1ed88eac64008f1eafcdfd9c32b749507fbf019186262ce84c8d29274b961d835e87853698562bde79b00245cf3f4d04d

Download Submit
memory/1312-83-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1556-55-0x0000000009ED0000-0x000000000A224000-memory.dmp

Filesize
3.3MB

Download
memory/1556-54-0x0000000009EA0000-0x0000000009EC2000-memory.dmp

Filesize
136KB

Download
memory/1556-53-0x0000000000BE0000-0x0000000000DFE000-memory.dmp

Filesize
2.1MB

Download
memory/4224-39-0x0000000005A20000-0x0000000005A76000-memory.dmp

Filesize
344KB

Download
memory/4224-38-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/4224-37-0x0000000005840000-0x00000000058D2000-memory.dmp

Filesize
584KB

Download
memory/4224-36-0x0000000005D50000-0x00000000062F4000-memory.dmp

Filesize
5.6MB

Download
memory/4224-35-0x0000000005700000-0x000000000579C000-memory.dmp

Filesize
624KB

Download
memory/4224-34-0x0000000000CD0000-0x0000000000D02000-memory.dmp

Filesize
200KB

Download