09bfb2b9045773f123de5aad102a6cc08bbad620b7cd35fa926b624ef1e7ee30

Analysis

max time kernel
300s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vanta Paid.exe
Size

165KB
MD5

dee04dfb6b2dd1b73a5c6b83911c4bed
SHA1

a80516d112d08fc820ddaaf6e6e972c088a2dfe2
SHA256

09bfb2b9045773f123de5aad102a6cc08bbad620b7cd35fa926b624ef1e7ee30
SHA512

209734045eb5efb01a0527db8bd74ebc027f3922b1c0c2caaa9eaa1e0043b22aa5c5845629d97aff698eb13ead2b111ff9a7d05df37ddd5e4e014f2426733c23
SSDEEP

3072:Fw19/9Arq7DWCKoXiO4VIaGEcPkGmK9LxBbqp2h2q:FwEwyxvcMGmCBbIq

Score

7^/10

collection credential_access discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Vanta Paid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	StartupHelper.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe	StartupHelper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe	StartupHelper.exe

Executes dropped EXE 9 IoCs

pid	Process
3844	StartupHelper.exe
344	StartupHelper.exe
3372	tmp8529.tmp.exe
3356	browser.exe
2548	email.exe
2572	StartupHelper.exe
4228	StartupHelper.exe
2124	StartupHelper.exe
696	StartupHelper.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	email.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .."	StartupHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .."	StartupHelper.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpA2EE.tmp.exe"	StartupHelper.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3844 set thread context of 3204	3844	StartupHelper.exe	165

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3204-209-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3204-210-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3204-211-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/3204-217-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\StartupHelper.exe	StartupHelper.exe
File created	C:\Windows\StartupHelper.exe	Vanta Paid.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vanta Paid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	email.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	browser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\TileWallpaper = "0"	StartupHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\WallpaperStyle = "2"	StartupHelper.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1864	schtasks.exe
4980	schtasks.exe
4060	schtasks.exe
4908	schtasks.exe
3880	schtasks.exe
2448	schtasks.exe
2700	schtasks.exe
1260	schtasks.exe
920	schtasks.exe
2340	schtasks.exe
4396	schtasks.exe
4400	schtasks.exe
1336	schtasks.exe
2524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe
2220	Vanta Paid.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	Vanta Paid.exe
Token: SeDebugPrivilege	3844	StartupHelper.exe
Token: SeDebugPrivilege	344	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: SeDebugPrivilege	2548	email.exe
Token: SeDebugPrivilege	3356	browser.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: SeDebugPrivilege	2572	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: SeDebugPrivilege	4228	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: SeDebugPrivilege	2124	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: 33	3844	StartupHelper.exe
Token: SeIncBasePriorityPrivilege	3844	StartupHelper.exe
Token: SeDebugPrivilege	3204	vbc.exe
Token: 33	3844	StartupHelper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3276	2220	Vanta Paid.exe	82
PID 2220 wrote to memory of 3276	2220	Vanta Paid.exe	82
PID 2220 wrote to memory of 3276	2220	Vanta Paid.exe	82
PID 2220 wrote to memory of 4908	2220	Vanta Paid.exe	84
PID 2220 wrote to memory of 4908	2220	Vanta Paid.exe	84
PID 2220 wrote to memory of 4908	2220	Vanta Paid.exe	84
PID 2220 wrote to memory of 1644	2220	Vanta Paid.exe	86
PID 2220 wrote to memory of 1644	2220	Vanta Paid.exe	86
PID 2220 wrote to memory of 1644	2220	Vanta Paid.exe	86
PID 2220 wrote to memory of 4396	2220	Vanta Paid.exe	88
PID 2220 wrote to memory of 4396	2220	Vanta Paid.exe	88
PID 2220 wrote to memory of 4396	2220	Vanta Paid.exe	88
PID 2220 wrote to memory of 3844	2220	Vanta Paid.exe	94
PID 2220 wrote to memory of 3844	2220	Vanta Paid.exe	94
PID 2220 wrote to memory of 3844	2220	Vanta Paid.exe	94
PID 3844 wrote to memory of 1268	3844	StartupHelper.exe	95
PID 3844 wrote to memory of 1268	3844	StartupHelper.exe	95
PID 3844 wrote to memory of 1268	3844	StartupHelper.exe	95
PID 3844 wrote to memory of 4400	3844	StartupHelper.exe	97
PID 3844 wrote to memory of 4400	3844	StartupHelper.exe	97
PID 3844 wrote to memory of 4400	3844	StartupHelper.exe	97
PID 3844 wrote to memory of 4600	3844	StartupHelper.exe	98
PID 3844 wrote to memory of 4600	3844	StartupHelper.exe	98
PID 3844 wrote to memory of 4600	3844	StartupHelper.exe	98
PID 3844 wrote to memory of 1260	3844	StartupHelper.exe	101
PID 3844 wrote to memory of 1260	3844	StartupHelper.exe	101
PID 3844 wrote to memory of 1260	3844	StartupHelper.exe	101
PID 344 wrote to memory of 4004	344	StartupHelper.exe	107
PID 344 wrote to memory of 4004	344	StartupHelper.exe	107
PID 344 wrote to memory of 4004	344	StartupHelper.exe	107
PID 344 wrote to memory of 1336	344	StartupHelper.exe	109
PID 344 wrote to memory of 1336	344	StartupHelper.exe	109
PID 344 wrote to memory of 1336	344	StartupHelper.exe	109
PID 344 wrote to memory of 1556	344	StartupHelper.exe	110
PID 344 wrote to memory of 1556	344	StartupHelper.exe	110
PID 344 wrote to memory of 1556	344	StartupHelper.exe	110
PID 344 wrote to memory of 920	344	StartupHelper.exe	113
PID 344 wrote to memory of 920	344	StartupHelper.exe	113
PID 344 wrote to memory of 920	344	StartupHelper.exe	113
PID 3844 wrote to memory of 3372	3844	StartupHelper.exe	117
PID 3844 wrote to memory of 3372	3844	StartupHelper.exe	117
PID 3372 wrote to memory of 3356	3372	tmp8529.tmp.exe	118
PID 3372 wrote to memory of 3356	3372	tmp8529.tmp.exe	118
PID 3372 wrote to memory of 3356	3372	tmp8529.tmp.exe	118
PID 3372 wrote to memory of 2548	3372	tmp8529.tmp.exe	119
PID 3372 wrote to memory of 2548	3372	tmp8529.tmp.exe	119
PID 3372 wrote to memory of 2548	3372	tmp8529.tmp.exe	119
PID 2572 wrote to memory of 2700	2572	StartupHelper.exe	123
PID 2572 wrote to memory of 2700	2572	StartupHelper.exe	123
PID 2572 wrote to memory of 2700	2572	StartupHelper.exe	123
PID 2572 wrote to memory of 3880	2572	StartupHelper.exe	125
PID 2572 wrote to memory of 3880	2572	StartupHelper.exe	125
PID 2572 wrote to memory of 3880	2572	StartupHelper.exe	125
PID 2572 wrote to memory of 3684	2572	StartupHelper.exe	126
PID 2572 wrote to memory of 3684	2572	StartupHelper.exe	126
PID 2572 wrote to memory of 3684	2572	StartupHelper.exe	126
PID 2572 wrote to memory of 2448	2572	StartupHelper.exe	129
PID 2572 wrote to memory of 2448	2572	StartupHelper.exe	129
PID 2572 wrote to memory of 2448	2572	StartupHelper.exe	129
PID 3844 wrote to memory of 4056	3844	StartupHelper.exe	131
PID 3844 wrote to memory of 4056	3844	StartupHelper.exe	131
PID 4056 wrote to memory of 2652	4056	msedge.exe	132
PID 4056 wrote to memory of 2652	4056	msedge.exe	132
PID 4056 wrote to memory of 2136	4056	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3276
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4908
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1644
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Vanta Paid.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4396
- C:\Windows\StartupHelper.exe
  "C:\Windows\StartupHelper.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYANP /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\dump456\browser.exe
      C:\Users\Admin\AppData\Local\Temp\\dump456\browser.exe -f C:\Users\Admin\AppData\Local\Temp\\dump456\pass1.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\dump456\email.exe
      C:\Users\Admin\AppData\Local\Temp\\dump456\email.exe -f C:\Users\Admin\AppData\Local\Temp\\dump456\pass2.txt
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8669f46f8,0x7ff8669f4708,0x7ff8669f4718
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5705567709766875130,13089189211675213445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:5028
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\4602561"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3204

C:\Windows\StartupHelper.exe
C:\Windows\StartupHelper.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1336
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1556
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:920

C:\Windows\StartupHelper.exe
C:\Windows\StartupHelper.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3880
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\StartupHelper.exe
C:\Windows\StartupHelper.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4228
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:452
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2340
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2524

C:\Windows\StartupHelper.exe
C:\Windows\StartupHelper.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2124
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4892
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1864
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2700

C:\Windows\StartupHelper.exe
C:\Windows\StartupHelper.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:696
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4980
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4604
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\StartupHelper.exe.log

Filesize
408B

MD5
40b0c3caa1b14a4c83e8475c46bf2016

SHA1
af9575cda4d842f028d18b17063796a894ecd9d0

SHA256
70e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867

SHA512
916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
293016fc765b959ef1125a45f3336bb2

SHA1
5a7be83322667f2f4d8a9362a61676cec67edbcf

SHA256
1d2c0d5f6280b8ffdd7bc89d3a938f7720c761f1b23a2daac62c39b6902ce826

SHA512
db74d6d9cea10900041f41ad030d465b5d289136aec2f59eea1f4b1013d52fd38c6c32c30c16e1cc7fc64c98f1fae11897db780cf9410dd49fe2204c905fe6ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
814B

MD5
3bc83cf1a668ac64a4aa7e60e215f191

SHA1
daafb30e18f62a67f9d259b3e5b5b5aaa4f34b6f

SHA256
83c1eaaa230d2ccf73a2fe734cbdda69e48d3778fccd8b737921f60f39080485

SHA512
30707940cc39877226017804098fccf4c36e752fab0cd8cbbb3ef2a3e1c712277c2ee986da234367bdd7f1d8743c3dc345bd1429eba0189e72c2c1228f9e4bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f93a948d5076469ff0be0ca763a1ef8

SHA1
07a9c77714446092625d44c8513c49b6b1f0be33

SHA256
2bac2c45797eca3ef70a806aa918502a1499e19dc62b7bf2e9c4f7d07db0b258

SHA512
0bf8739934258278a4ee2dc48d3d24323584b642ba1e0dc67dd025e347690db148ff2ee454e04ef2323438a58cbe5e068c7346889e3414b7272df76b1ee35bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09e92706d248a272bdbe1bf3abb3248c

SHA1
44f48279de10be72f1dcc70f680f5a3f31071d37

SHA256
23423a52d0f24a5181b096fda32533ebc8238d4cfbf79e7120f1fc4cb88ff3d6

SHA512
e3c46b653a3bcac8ae30476ce2dae948035b358a084e43993bff60153411d4897ba3ff5c4e96ae66863cfcbf301ca7ca4daaf900e0f5aeebc7699008cf22b2d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
86f6d81dc74fecd8e2eede94f08acb5d

SHA1
231e1586810733e041ea32b118cf3fb8b940d835

SHA256
2c980da34502317497efc450f4e357152e2c30cf00cc74799b0ab3f10d959497

SHA512
d500338ee327251bb4b893ecd2cf691907be90c9a0f0a7a4fd59d72a155a8cfd9588cac5e8081bd74705c7897bda411940e488a258828448b00f0536d3890d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\4602561

Filesize
507B

MD5
6d0e849b0647746facd7c73f03b4d366

SHA1
3138201a6608428b922bd86168b51cf80615bc91

SHA256
c2f229ba47f29fccb6d35a908e887bf97e9e87cdb1110e855d5caa39571e5d72

SHA512
3839589f64141ba269f95e2726dd040ee09b6c9c09f5765dcdba847b02f68fa000b588a272f17e73ac42e81b3bb154535dc20da6dce0682b4b3a1ac2daada86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dump456\browser.exe

Filesize
439KB

MD5
10ae9f2eb3e7e79590493c47e39eb04b

SHA1
87490001bce150fd684e6ffe9343aa8f62dac963

SHA256
2a403b01727b1f8d2a7079427946f178c3c66dc17a00e6d1ab7547b11680d012

SHA512
764cd1f5f5466dbb55ec8ee1360ec8a8671468c761d3f70e2e9bc4f548e1d4bb920254abf68eb6c3c2a44bad7e9d7e7c205d4e316d3d0fdab2f2f55e398f9ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dump456\email.exe

Filesize
464KB

MD5
9b222f92f7c7da9287e5daa968638638

SHA1
99b8f6deaa13d04e9ec49a23eadbc9736209df26

SHA256
941d0b28c048462fcaad246d6c0721d261a18d233732bef9a900adfb29ad7364

SHA512
8ff915bda99d0ea3a5426c2f92c9f583af8a4aa162c3fddfe0734d7617135a1fa5f6a85ec5eae80a1f0b9f95e595e53998e3da262aa5bdc4489a0876010472e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dump456\pass1.txt

Filesize
1KB

MD5
eb27d56cb9e5b4421481a5f43e41649f

SHA1
2bc61491c880e4938a664d60a982616a2dfcf8d7

SHA256
9c8df096357fd180fa3b2194adf7a5e7ab1f75748befdfdd8f90496e0bce3772

SHA512
e52ddb5128d03bd1ae490476f1877319eae7f7b8504879c02e5fa9940a0a6aaa60c92f3d4a9a557b95d5a07413f88b0f2b66594eac41405061808dc959991a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dump456\pass2.txt

Filesize
400B

MD5
51e38a852a05cc9718fa3f68041e9dad

SHA1
dd4bee5a01be174c3fda9904c61cfb2c41ede71c

SHA256
b6e9dcb02e18ec89d3e003c56fffab57b9afb032f89f5a7826b729311938b288

SHA512
197fb341edd0185948ff9739368ab0bea74012e87c9d27a67a665af50be2df7d6305b336e16cd1cec04dcca330dbbf6103d942ca9796030eb0b67fd331bea675

Download Submit
C:\Users\Admin\AppData\Local\Temp\dump456\pwd.txt

Filesize
1KB

MD5
23f048c69f5fba81d7e65d77465ebf2e

SHA1
71d2a314f3538e8859ee0064e888c930612920cc

SHA256
95930f1dcfb13bea11b4f40d03f1dcf098bec29c250baa6f6f6f896c27044170

SHA512
c60d8a0d9dd8beaf467a276da7e4a40fc279eefbc0d4406a1d1a679b8709d21a72dcf9518bfe68358715a7b8976f655aceb91ae95c2e6d35e59653a205c14688

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp.exe

Filesize
915KB

MD5
2e17223a079a3957be8009ebed5548fd

SHA1
63c6378d766db9b0a4a5cd960d9f5b6184d867e1

SHA256
eff6d9f2f2609be04c69339c21b69b77c6b2f9575ff1b8ea3218426032f28a29

SHA512
2b31424278b60708045e8ce4e3c7519fcf409aa755ccd8e942cdfee4e127112dbbf2f34e7e161cd511c21594b2679fd7c926848d7591f3283d4d9cb71f40a60f

Download Submit
C:\Windows\StartupHelper.exe

Filesize
165KB

MD5
dee04dfb6b2dd1b73a5c6b83911c4bed

SHA1
a80516d112d08fc820ddaaf6e6e972c088a2dfe2

SHA256
09bfb2b9045773f123de5aad102a6cc08bbad620b7cd35fa926b624ef1e7ee30

SHA512
209734045eb5efb01a0527db8bd74ebc027f3922b1c0c2caaa9eaa1e0043b22aa5c5845629d97aff698eb13ead2b111ff9a7d05df37ddd5e4e014f2426733c23

Download Submit
memory/2220-18-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-2-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-5-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-6-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-1-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-3-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-7-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-8-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

Filesize
4KB

Download
memory/2220-4-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/2220-0-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

Filesize
4KB

Download
memory/2548-54-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2548-48-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3204-209-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3204-210-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3204-211-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3204-217-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3356-56-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/3356-47-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/3372-38-0x000000001B1C0000-0x000000001B266000-memory.dmp

Filesize
664KB

Download
memory/3372-40-0x000000001BCB0000-0x000000001BD4C000-memory.dmp

Filesize
624KB

Download
memory/3372-39-0x000000001B740000-0x000000001BC0E000-memory.dmp

Filesize
4.8MB

Download
memory/3844-19-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3844-20-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3844-23-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3844-24-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3844-25-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download