a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec

Resubmissions

08/06/2026, 14:13

260608-rjgt6afw2w7

08/06/2026, 12:59

260608-p8a2ssev6x7

Analysis

user interaction
yes
max time kernel
210s
max time network
208s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
Size 16.1MB
Sample260608-p8a2ssev6x
SHA256 a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec
MD5 c5344a94b38ae0ae1a75a2f83a0f6fe1
SHA1 5ee81f835d9b2df4731b6a57d212b6bc49a67790
SHA512 f2f0ae428b5e697b5110b22f8ef035e3d529f24f13d74440c8aa8f706b0d9caaeba7c81baea0a2f0be9548fe412ec666c648c9abfc28766396604dd6ff904ec5
SSDEEP 393216:T0cHWFEL/FMGnvi6mIuhnzVkRU51a67oi2FHfifqSBI4kUM:T0xw/OGnviXNpmRU51Wi2Uqz43M
TLSH
T1E107330AFE2A6442F9DD1BB60103A35BFD0007566B6E48EACA59E31D507A1B7BF1C50F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1864	Document Transform.exe
2988	Document Transform.exe
3096	Document Transform.exe
1640	Document Transform.exe
2176	Document Transform.exe

Loads dropped DLL 19 IoCs

pid	Process
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1864	Document Transform.exe
2988	Document Transform.exe
3096	Document Transform.exe
2988	Document Transform.exe
2988	Document Transform.exe
2988	Document Transform.exe
2988	Document Transform.exe
2988	Document Transform.exe
1640	Document Transform.exe
2176	Document Transform.exe
2176	Document Transform.exe
2176	Document Transform.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe = "11000"	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Document Transform.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Document Transform.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Document Transform.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	Document Transform.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Document Transform.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Document Transform.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Document Transform.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Document Transform.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Document Transform.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Document Transform.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Document Transform.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Document Transform.exe
Key created	\Registry\User\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\NotificationData	Document Transform.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2176	Document Transform.exe
2176	Document Transform.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1864	Document Transform.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe
Token: SeCreatePagefilePrivilege	1864	Document Transform.exe
Token: SeShutdownPrivilege	1864	Document Transform.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
1864	Document Transform.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1864	1904	a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe	82
PID 1864 wrote to memory of 2988	1864	Document Transform.exe	83
PID 1864 wrote to memory of 2988	1864	Document Transform.exe	83
PID 1864 wrote to memory of 3096	1864	Document Transform.exe	84
PID 1864 wrote to memory of 1640	1864	Document Transform.exe	85
PID 1864 wrote to memory of 2176	1864	Document Transform.exe	86

C:\Users\Admin\AppData\Local\Temp\a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe
"C:\Users\Admin\AppData\Local\Temp\a68df40a9ec6356b2f9f148a37c424d470b4228cbbc5c0cc7f071dd5f14d75ec.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe
  "C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe
    "C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1440 --field-trial-handle=1592,i,1886330613450400984,8320242738494252929,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2988
- - C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe
    "C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7" --mojo-platform-channel-handle=1948 --field-trial-handle=1592,i,1886330613450400984,8320242738494252929,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3096
- - C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe
    "C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7" --app-user-model-id=document-transform-nativefier-fdb4b7 --app-path="C:\Users\Admin\AppData\Roaming\DocumentTransform\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1456 --field-trial-handle=1592,i,1886330613450400984,8320242738494252929,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1640
- - C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe
    "C:\Users\Admin\AppData\Roaming\DocumentTransform\Document Transform.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4092 --field-trial-handle=1592,i,1886330613450400984,8320242738494252929,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Banner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\Banner.dll
Size 4KB
SHA256 189a30bd5802d2f43256c9f8958a7ec7fdf794a6a681731c85af01796d13582a
MD5 4e50e372bed7882789360c37b1369e0d
SHA1 24aa9ddf67ebae447313082d12b358029cc0070c
SHA512 c05db65d19621132cc91ab09ce8ae7edc0906c1b9eff80b20921147de451138921b384345f98e88ee9fec8328a130a9d2bcb0e68cef794e81da3d26325a87500
TLSH
T1B781633BB2F04EF7E563023300830BD3259BA954A728471A4D67A1ED764A9D7D53DB02
MD5 SHA1 SHA512 TLSH

Submit Download

EmbedHtml.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\EmbedHtml.dll
Size 767KB
SHA256 888fd9e1baf6e78c41c87ddc203b84d754ae5f73167876e3bf83a5253c375d8e
MD5 d1d5fc1d51cbac6171601d3f990e0cc8
SHA1 fc3b32f7ad1e717a7f31590dd6c02b8417d7c75d
SHA512 571e2b767608bf502f3cf7a320ce5d93571168510a37e6aefd37c43ce3319feb8211bebcca1274f13deaac0c444366ea2091a9e4a744344874a22f9294370a54
SSDEEP 12288:39nfbYbyicF595btShv/NMAPjhxBDcoBJHD/Yd1QPN+N7Eq:39nfbYbyi4595btShv/NMArhvcoBJiQ4
TLSH
T1B8F4C4C2E2A5F656E3A700719C0962D50A612E303394ED67BFC632858D3A1E7E5E1F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NScurl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\NScurl.dll
Size 7.2MB
SHA256 f41c74c3024c8640e82e924db0af73b2fb04dd65e8f239af745926b2761a8162
MD5 578986617b7a4e3c93adfd9172705a53
SHA1 162efb4fc94797726f7d360643b45011a3280cda
SHA512 19d7e0cb8a3eb957c0cc611d51db64d01242b8e5454a8fe03c269f7d964b73f28e3e6b48cf4218402a88ffd1fb8ce26f7c865c4cbfe6fcd29031d6bb563c7a9f
SSDEEP 196608:zXr8P3PrSYc4SThnIhr8vOKnbDR8ncC9NRlrn9PGYAY0iT6V:UnEkTT2
TLSH
T1FF763A94FECB04F1E55384B0D8DBB37F8B349B018125E6BAEE4C5E56F933701252A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eula.html

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\eula.html
Size 2KB
SHA256 9c0c0ad6ad8378551421514f046b945074f678b105e2640c9794a483b76e59ed
MD5 cb19589828799d5f33cfe69a03f244ac
SHA1 780629a1637ef5e6cc397e401946f4acd98b3b67
SHA512 18dda77e19bfef79735f3ecf47cf13b2737b2d6aa2d78cc910e6a016b39b944ec22a02196dc188e0d3a5e1dbbede655eabd5aa6584b823d69424d2e304b86abf
TLSH
T1B541FE6C739337224AB006141F4683E8EB169A77636A2191F5CD800B3FB291086F37DE
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu4478.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\chrome_100_percent.pak
Size 126KB
SHA256 662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0
MD5 a3d4515d3a33a407d313a62818e82a5d
SHA1 967ff9a6774a66f7b3299af4fd5d70961ed54d79
SHA512 0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801
SSDEEP 3072:KKzwqCT4wKN3/nXCWZQCPxBVO2o418Gb0+VRLf0ld0GY3cQ39Vm2I:KKzwt49NPyCtoK18Gb0OV8ld0GecQ3f2
TLSH
T1B0C3E1E7B3F4EE7DCBA756B3A11501B2EDB246250692034A078FD8352A76749DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\chrome_200_percent.pak
Size 175KB
SHA256 d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc
MD5 3bab45c70f22646cf8452c30903810cb
SHA1 40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766
SHA512 85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c
SSDEEP 3072:9sDQYaEQN6AJP1N3/nXCWZQCPxBVrfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+9:SDQYaNN681NPyCt9gx5GMRejnbdZnVEd
TLSH
T11304E1DBA3B89D7DCA631BB3622501F1EDF2113555B6424A03DFDC347A9AB8589CC283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\d3dcompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\ffmpeg.dll
Size 2.7MB
SHA256 b41724b74995de9143bd721f411026300dd8c1d9365ccc050f45e7d53d7e6bd0
MD5 0dcf96e8b2c02f76d97ecc407c7ea77d
SHA1 2b576ac09a4c1d94bbea092e025afbb6c68b9516
SHA512 48762c5728dd7432855f1e0bcff32cb928aec74fe52343d830483e86b724637603eef746a7fb232f440c12e9842332e1e13e79aad39c51f6ff31e8d7b622b616
SSDEEP 49152:xeyh3pgdFz4JsjJlusen1z8At7Eyb9f0WgARJ21yTZQViU5UkJQ6Vht3ktb:AywOseZtt7/LJkyTZQViU5UkJxtQ
TLSH
T1DED59E07E6D640DDD01DC27487AF9233F931384A8724A6DF2A9196252F3AFD06E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\icudtl.dat
Size 10.0MB
SHA256 51edd31f6c5d298c662af320424b632172a31e3348cdbb201380636c95ded794
MD5 516f6b90d1539bd1eaeaa2fc32dadb92
SHA1 8017789bef98902cdc95c18e67b84378ddd293c0
SHA512 db4b5fd7f8a0e0a331ffa7c574d011b059df8654cdc6ee4970f84fda20b88a3b8706f2605d91d19a6dd86d2702cc9542e026a054d28f85c51b676daa8d3f3bb0
SSDEEP 196608:zTzwSv9AAyM0agliXUxCGZHa93Whlw6ZEtZ2:zoKlyMqliXUxCGZHa93Whlw6ZEt4
TLSH
T1B6B62907A2FB4EC2F9F7AF30D9F152679467BD496E31805A11442F3B1C337A08661BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\libEGL.dll
Size 458KB
SHA256 b37c73ca0c943a0266da65729c2da8e9395212c6825f2ed78dd43e337116463b
MD5 f2ffcc56ca9fd32679d6e0d318dd5eb8
SHA1 ecc6951ee87536541ab71f28a6d643dc8b193f9c
SHA512 8c4343a637cb33fb5213056df266907c6d9fb245631cc4ef337f19f820cf183ea008f2173d632a8e348d67c4e15b695dbc59cd6f4da7cc3a21e644e83fe255a1
SSDEEP 6144:wCm0Qm7we62b/jvtGs1+xBAS48mozraKNRqNcWePy/Dq16VAHa:wejwefb/jvtGs10BAS4ifqgy/Dq162
TLSH
T1EDA48D16B79444B9D06AC074CA634643DE72B8920F65F6DF03E4926D2F7BBE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\libglesv2.dll
Size 7.1MB
SHA256 03a93c4a817062e7c0397b3d838bf1e05c13978441d879146af63667524e54e8
MD5 d25fc30be7c7f0e8b9299b355b86138a
SHA1 bf6038b3d91dc48b835a5015f55982a6d1d1837e
SHA512 370c616e3c087894cef7b6bc366ef2e16e63d604dcc5b640edc96bf700ed0c38b89e242b74c397bd1549bf6c802f7a336989039dab61c3e0bf3f3447891d8437
SSDEEP 49152:TCVJ1Jx2WG4vs+ECmI6LRRrpQ2NUYzi6fPXqINTCrTKkd9L119I0GZvDuKVofuaQ:WlKzI28wx6lF0KbxLZvA+Ju4nw1
TLSH
T1ED766A07F29180DAD05DD2B98B5B9222EA31BC861320B6DF22A577113F73BE46B7D354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\locales\en-US.pak
Size 295KB
SHA256 c4a2c6a90945868a02ad14b3a994e94b123981d56190bd34cc3cb14f31f2270b
MD5 a2ed0e17819c287b824cae5c0ac03af7
SHA1 9694627f89cd65fbb511eacc6c785ab045525ff2
SHA512 a527351a1c61e6ed4e999c6549ec04b2096712644c4e1f28b48872c031c9f0a4bb118c0ceb40dc3a35315ddc7cf244e3c0c03d864a53d4a76f6dcf1b3889c109
SSDEEP 6144:xfvPBH0g+FtIpphRO6osMP9elM7BBfaYM+R9X5GSOmzwS:hpYIHPosM/7BQ+35GSNzwS
TLSH
T10F544D1FE784126A069312627F0656E3FB25D0ADA35112663CBC802C33B7B66D3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\resources.pak
Size 5.1MB
SHA256 d1c062104f136edf33ad4d89460b2e4d9c1e463e792834ab91ef7d2a11953794
MD5 915f50ee09363c2e946fa60c3080d97b
SHA1 38038c4bee8780aaa89936534e5559fbc6aec953
SHA512 c59543522ae69753996a9912a2dec751f16dab7175c2073864253f77087654d895d12191815b257408b7442d027b0717c6a0d4e5e0b8948a3e60543197c1f10f
SSDEEP 98304:YhFdIHa+WSTCCDw/xcljwglh1eZML3Arwr/NGKwkT+E59zqaPqPXSF7yOzy2oeUn:S+WSG+lUGhkMLQkrVWk6q9+nPXsq2oek
TLSH
T144463311F3A01D37E2D6933AD4A840372D35D18759A2BC2CF4CE211E8F5CA9B16B976E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\resources\app\lib\main.js
Size 507KB
SHA256 c21eb14ba63e943db5ea9ab64af02a50a17260c7d8538a133c4f6e0957d36f47
MD5 415a96f247ec0477080f576a4b91f7a1
SHA1 f7a060bc408acfb14ce59e40710b630291c76540
SHA512 35d7664411863667d11ab537878b6b2f458b747ce68ea7d88820321a49320f19d15e92e45e53b2549ee08c48d8244ca8315b5378b5028bebb1e9b2ca0a5698a3
SSDEEP 3072:wApyG/SXf4Ltz1oz93TSEF7MJFfAe14kzlJ2IvzWB6IdStKlF6ht1fzS0n9d3lXo:acwtNgBAe14kXznB/S0dwIkE6nFG3pK
TLSH
T1E4B486E7341659B24FB6A37ECF56A694F279402BE0C4940EF9AC81841F7013D43A6EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preload.js

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\resources\app\lib\preload.js
Size 12KB
SHA256 d50ca2fa212df1c1ff69b5d26ba594bd39bfd86a71b068a650cc577e5dc9a94e
MD5 cfd7e6489b0d63738319982f68ff935e
SHA1 d05ab48d9dc3a52946511c2c4cf5de0fcb4f1290
SHA512 9b4c0fb83033163f8e8e35c9da2d33265f7d36eefa22774399abaf867e3d22a3e0cba71f2bb2037fe055e5b9932b25dd98a63b7543c3a15f2667ec40d7bcdf93
SSDEEP 384:0xmqIbYaJ0EpNs96qzMSnu8rl+InFGsyR:MmWo0EPs96qzMSnu8rl+I6R
TLSH
T18B42944F39F329311977A47A9B3FE109F73A9403D248D4007ADD86681F31A6146E7EEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nativefier.json

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\resources\app\nativefier.json
Size 1KB
SHA256 2aa45f4c98639844a65a54b81da89ffa82b622020d2092c36396b2c45c16154a
MD5 de833d4899cc998c41432376d6cec544
SHA1 bafc10dc4cefca139a23df29dca6652f71c3bbe6
SHA512 3cfb7d677658ab44e71670f2657e76bc59b545b4530cb8abcf18ce682bce664b574f0bf908c13ffde62704e58a1226ba2328967c2af42ceee31f7dc5d12c0f53
TLSH
T17611EB3D5B6511EC85089386D2BD6B88872C166BB040FA9CD1BC050D31E7BED523558B
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\resources\app\package.json
Size 605B
SHA256 27f6e272a386a480ff3b360f7138fc548fc6df33af23c1bdbfcfd841da392c08
MD5 5b1dc81c49c1211e5842472bcd510fb6
SHA1 445feb7bfe5a4cec47155e15ae638e856c14772e
SHA512 6384de792c8ba0574d67e18edcd1eefa1de3eb57b29d5d71612fa112c99bbe7a21c4717d375523ed13d31076d75fde26c907f4dfde4d451ced6dd8aee0cf9790
TLSH
T122F04C14D99598B305DDAD56256985D663218D8B484CFD0C77E3030C0A5C47F54FD6EF
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\v8_context_snapshot.bin
Size 716KB
SHA256 1717afb2f6958e37a34ab35b5b796ff2d9fa7d0d4828a405221ac3260b722973
MD5 7ea15faff14c6631ef7ef7899ec8235d
SHA1 b398fb7e8e3afa7886c483b054be4358aba5b800
SHA512 57e6fdf0c6c64f232fe6c247b955689bba09a9c2bd37124b3b4b419403ee1f1028b5eed6b1e3f96263cbc1762d3c2637e06ffb3a04891772d67487ee2fd8db45
SSDEEP 6144:G3H4NhudRgXWwaNhuD8AiMSZbG5J5TR29LxgXdej8Zvx/YUN03LF8ImGjx5liLAD:9huIMhuA1TONhZvx/Y57K+15MLA7P
TLSH
T1A8F48339F711CA26DA174DFE1EDEC5487172F604AF8209AF71A98B4E60EB7181CB52D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\vk_swiftshader.dll
Size 4.6MB
SHA256 99121fbf7392f676a4e48d914710517f6b9ef519ba04e7ed7385d6279fbba1d4
MD5 07e593bc5640953782f2bf7202e2ca21
SHA1 ce0430ae4a3dc397ea4dcede82931a7e0c5b85ed
SHA512 df82de0965ee1a3387d88764b60b034c54f79de69ac2dfd11c289024efb093425da1e6d3554b255c6dd24f30b7a5001b1b4e41e1bf812aefa76945fa24466e7d
SSDEEP 49152:r0mGT8uVky3/yi3V5QuVEym0y8za7U+uzaXkZ/uQqt4+E9Q84Rb9WbUrW0Gnehua:Ql/gW3OLbc4qE
TLSH
T1B5364A03F2858199F05ED57D874BA622E632BC801B7276EF52A02F152E77FE05B38719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Roaming\DocumentTransform\vulkan-1.dll
Size 849KB
SHA256 e1c91b7abb0b3811e6b2ed80c9a9b1f8c6377deeb5ff41962f4c48a9f2ec4e64
MD5 851a1ba1942a38a04d0eeb24c8d4607c
SHA1 d17693ff6c30fd604ab71b2ca4fa455d725d351f
SHA512 2be38ad05c757fc5c057d241519302fbb402f5650bbe976ac770a83e900d0d672d1f5900c519048902d86acca763b25562dedf5ea86746451779c311ad49c909
SSDEEP 12288:uuVhWbJ81GuHFcwx4rbJOvT8imTeZExRHbwz8g4oH0/Rn:uuubJehHFc+QWGeZUGzonRn
TLSH
T199055D33A6948566E47AC035D9C28603C9B17C911B26B5DF03A86708BF6FBF4277DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5dfe84f3d1f2f927582fc71035d4e8ea3d90c88a9132d9e73e47a860616e9b4c
MD5 8bf4499332fca59627daacdcec2281cf
SHA1 55a39b9295d19141938a3046a6c3ae3100e73df4
SHA512 0dd38b6a3396061a7cac8a77d8dd2a09f8bcab3fee8d69dba6280c256e3a9790548b5d90c85e424152e806216ea72abefc6b6a4744a3c5792461728ae17b7e24
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 79ff7719644861e0da160c0ce8cdf62916c671ea828096e81adc2faf5595feff
MD5 7c89ac65cd3bcfdee16fd67cf30532ac
SHA1 f9da6f34ab761787a7a3c4f9b6cb079c4f1710ee
SHA512 8dd68c32dcc19c6f025f7436c0b139ed2bc630e9fa5f56b21f52ea4259f92d02dbba74b5c6713fdabea3a8f8e4353a2fd6717ec38f12326732c4839303945693
TLSH
T1A2B002EFC52D1433C60117F4D9EA37C0313A0DE003430E9655B932BFB5A57AC91A3008
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7\Network\Network Persistent State
Size 764B
SHA256 e3c7c36ccdc5d7280a204f6236b6272d0f5fdc3613bde1057fc6fc45d40dec2b
MD5 cadd6cb30081673738d6b7c2ecf22c40
SHA1 6aa81e6a78d6e13244f6bf45c94d8c35db2f7474
SHA512 8388191fc51f395595bc19b39ea0e975441ba124f4b5d8f3c84e3f22d971c1ca5389bdb157f91ba2fb028f47454f0d7590c0d350a6cfd8d681bd0f9eda545f5d
TLSH
T13A016DA7C2E849BE460283F57B253B13C5FE059D63583C4E89D85B5E53B1CB6560088F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a658.TMP

Path C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7\Network\Network Persistent State~RFe59a658.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\document-transform-nativefier-fdb4b7\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Document Transform.lnk

Path C:\Users\Admin\Desktop\Document Transform.lnk
Size 1KB
SHA256 f71a2017d799bca8aa809c6910b0f493295e4694293d4be148cb51a6aa61ca75
MD5 5fba0c585a0a45541aaae34cc2e2448a
SHA1 7747314fb8c1a85bbaf343eee8ee22d11bfc7ccb
SHA512 96526a5803ab299097dcf6f9a8b0b55bb4384c2e2c978776853471f3dc0b5620ae40de4726284a247d200aeb26afded16336fa77cd6125090dfd30880b9205cd
TLSH
T1B42133106BFE0BE9F3F7677013A69B3096B6BD42BA19E68C0414A2490870F00DB65B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1904-188-0x000000006F840000-0x000000006FF7B000-memory.dmp

Download

memory/2176-386-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-380-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-379-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-378-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-390-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-389-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-388-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-385-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-384-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2176-387-0x000002642EFF0000-0x000002642EFF1000-memory.dmp

Download

memory/2988-243-0x00007FFD5C120000-0x00007FFD5C121000-memory.dmp

Download