20471a44987c563b0701f18e5fa20b797fe046674f67563c8904b9a90e056394

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uxtheme.dll
Size 220KB
Sample260626-py547act4j
SHA256 20471a44987c563b0701f18e5fa20b797fe046674f67563c8904b9a90e056394
MD5 019b1572141a19a705df8b7f9c69cb4b
SHA1 d7d7798b17fd584cd4726c292e53a70a0f37f2ff
SHA512 78d257770b559402c8e64db82d64ea5509a0d126281af5be88ec05bd878c7f63559a0fbc26f745c0527d9ce5e2be3144d7498487902fef2684a1b807074962bc
SSDEEP 6144:PAskkjLGeh/c+5MZkaVYmcXRBkDKyLh8dUFZzk/zlpePF:PAskU/vjaVYmoRGzUUFeLy
TLSH
T10524126190D17539E8B906BC18C53374ADB0AC952AAE42CFE53AFB72193035C9673BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
19	2904	explorer.exe
19	2904	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
3248	demo.exe

Loads dropped DLL 1 IoCs

pid	Process
3248	demo.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\MicrosoftWindowsUpdateTask3792(Manual)	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	demo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	demo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	demo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	demo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	demo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	demo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	demo.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2904	explorer.exe
Token: SeBackupPrivilege	2904	explorer.exe
Token: SeRestorePrivilege	2904	explorer.exe
Token: SeTakeOwnershipPrivilege	2904	explorer.exe
Token: SeBackupPrivilege	2904	explorer.exe
Token: SeRestorePrivilege	2904	explorer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 6136 wrote to memory of 1996	6136	rundll32.exe	85
PID 6136 wrote to memory of 1996	6136	rundll32.exe	85
PID 1996 wrote to memory of 2904	1996	explorer.exe	86
PID 1996 wrote to memory of 2904	1996	explorer.exe	86
PID 2904 wrote to memory of 6072	2904	explorer.exe	89
PID 2904 wrote to memory of 6072	2904	explorer.exe	89
PID 3248 wrote to memory of 5700	3248	demo.exe	94
PID 3248 wrote to memory of 5700	3248	demo.exe	94
PID 5700 wrote to memory of 3692	5700	explorer.exe	95
PID 5700 wrote to memory of 3692	5700	explorer.exe	95
PID 2904 wrote to memory of 816	2904	explorer.exe	96
PID 2904 wrote to memory of 816	2904	explorer.exe	96
PID 3692 wrote to memory of 1712	3692	explorer.exe	100
PID 3692 wrote to memory of 1712	3692	explorer.exe	100
PID 3692 wrote to memory of 4640	3692	explorer.exe	103
PID 3692 wrote to memory of 4640	3692	explorer.exe	103
PID 2904 wrote to memory of 3864	2904	explorer.exe	106
PID 2904 wrote to memory of 3864	2904	explorer.exe	106
PID 2904 wrote to memory of 1560	2904	explorer.exe	109
PID 2904 wrote to memory of 1560	2904	explorer.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxtheme.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Downloads MZ/PE file
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6140

C:\Users\Admin\AppData\Local\demo.exe
C:\Users\Admin\AppData\Local\demo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 c6c25f2814546991b227f44b281544df40a62c26c3cdb9ff23c928011c0aa841
MD5 9b2b22578ec3ff3eb9efe5c4ed4638d4
SHA1 6ed40cb91794d23d08ee8e2b94bcabae2e536ac5
SHA512 19a37f66ee9dc9f310f27b53977c0f68640af55dd0884dccf0f3362d5b69a9138fccf495c2bcec6a8b33250279a03dc76b0ff548404b623cef3f2e1d32dc25c9
TLSH
T1CD41B5ED1E1C7464FF82CF459D79C6326D7DB1E0848465A572FF84A2308ABC42E1B84C
MD5 SHA1 SHA512 TLSH

Submit Download

3538626A1FCCCA43C7E18F220BDD9B02

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3538626A1FCCCA43C7E18F220BDD9B02
Size 1KB
SHA256 a9d89d47e6b76019d167134d4ca537dc48d8987fcb591b1e601c97cc1c02b8b4
MD5 32d79d81a43423b37472d62f185b9b6f
SHA1 3be9a0a05438b3982364bed0b2e1a83ee4837075
SHA512 4678c63ab33c8459b2ef300241a54a43d209546c3d8df1d84c5e702fabbdb47fb2b0b99f49c125528683e087ec58e4d071b32e23470c6b6737fde565bd8c6e89
TLSH
T18231D08821492233DD463D65CDCBFDE3ECB0324866D0905B4E95AB415821EBD5F865A6
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 727B
SHA256 c43606ad0ba1e79a1f6b17a36486c2f2d4bc07d4bc3b63dd09d693e223d22367
MD5 097643b53b85a07edfb7049f290a8849
SHA1 4eca71d106febfe0626602c6dbe064f30c932fce
SHA512 b227370a73e5135455b8792ab997446e8c3601db968444cbf8e07f1d0ee1c82c55282979154ffb84c62bce6bac25978e7aa5ebbdc5b504cab3f4347d5c34f53d
TLSH
T1620199148CBE5546FA364E2F47F4603C32D0EBF23DE426454AB3A0F45442BB6765B0B0
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 1KB
SHA256 fbcd92d1f6b864d6eef724db91cdd3023d16406ff26d851fd7ebe02383e8422d
MD5 59e04d03088125c127bcbd35d353d751
SHA1 556ca2b0d0342686e1cb58b03f92af33488ce39f
SHA512 f07976b5b226f100b78186e2b7fa9c3ea68cbf4595723d9a4da76980688cc4ffc5a8d58bd23268f50b193db1aec21887350942837810124888ddb83b1969c3cb
TLSH
T1CD31C6D3AF787901BE064DE0ECED4B326C7071E6F8640CB53964451F94A2FA0A906C0D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 e6ffa0d6a177681a72530e79405d082d62040c30d78578a90a54ef60b626cf23
MD5 5a68dc06f3a16fdb3fedd1783772d83a
SHA1 ceee938f15721a3f1fb5c7ce825207132002714c
SHA512 68ec8107e7e433bfa9d1f9f2ae8aa1186916775c71e2abbd97ffbf410525a649958772f2cbb518da105e7cfdee1859a32f12678ca1559f1a6ef26ab9c408ca85
TLSH
T1E541E9E72B0D3465BF41DF4968F9C93A1D7884A491841582757BC4D500AEB883A1744D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 d5d4014e4942f876d69fbe96deb2432c8d35951852eac139edaf5dcb211bb99c
MD5 96ffdd4443e6f614162a15c0e76de3fc
SHA1 dc139d52202b39b958733473ad7f29a1e752bdc3
SHA512 bf636e2675bfc24fdd44bed4591822ac22445c225f87ec40303c574c4bfa01a8ae09821ea3897dbf472ea5e660b842cb94acba3d204f948bc84bf9dc96c5cb51
TLSH
T1DFF022A83AFB943BF172DA3953DA71B04826F212300226B826B003052A05F206C42607
MD5 SHA1 SHA512 TLSH

Submit Download

3538626A1FCCCA43C7E18F220BDD9B02

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02
Size 330B
SHA256 5fd62d8cf566586511a77d503a4e887170f8fa5f534118a673e347142751a791
MD5 dc338d7e4ed21ad5b7034ed4ae13befc
SHA1 e15a8f675f58ffc3f4aab96fd1f8611f981e59fa
SHA512 46c886e4c83dece0630e713828f75b9e4c878d46464919651aa7c617cccd8296fc59df35dbbc4ae4c526221a2e3fe4fbe122becba46448b2904fb4e7109aa5c4
TLSH
T153E0C275ABCA4213F2BB067B8CFA12A14636754FF801EE9F0626134C2820A0859B074A
MD5 SHA1 SHA512 TLSH

Submit Download

A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
Size 484B
SHA256 4159f12ac0991360900ba8ac66bd4d574fa1cf8d3f3802fbf64cd5314c5304fc
MD5 4561299e34a1da9f8cc308d9f186eb8e
SHA1 3583a5504aede6192d9d0a04198139a3f2b7dfcf
SHA512 2bd3d2f2cc700e90ef767e3af231e22d7559dc580bcf02e79c03412a648a516c23d1c7e5d66c39e55e1b0cba85dec1d45afdf1f2e0cda9e3c2f7e3ac90e124f6
TLSH
T13CF0AB2C25ED002EE5E7BD799FFCB12A7A3DF106340152E85B66058B5005EC09C22232
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 482B
SHA256 5bf6fbd5b1bd6fc77984784dc7a9a01f06ae589b3dd1bb6df7a2a7a351477967
MD5 ee5320ca5d2886d92f1961adfaa6b254
SHA1 dc028828f182db6c1dfe22f3b7caa654b4ad04ad
SHA512 02ccd75f115d47337027b46580afcd133a6129421deb63a765a998baeb1c30481b6dce2eb3b9845a2feb7eaa4c0af27ceabe0a3075e7dbeec5a2e958a1a7ceb3
TLSH
T16FF0A3041EF9527DF4339C36CBD4A15AE8B97303284C565709610307E913D418D95977
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 a4d836640a5bd5ada7bdcf6137f87927e91f9c95139443d8e12aea0091749a98
MD5 17e04ceac0a3e30a3a7eb018fbdad7e7
SHA1 27b619e1354c19ef20a67adba9898d9fb6bb2708
SHA512 34c6a34ea32234020c255cc6310a55bd21736c3d42d90bd0a7becad07475d35b21fd8f83e3d66fe3055bb1cd29153c1038e4f925deeafb835f2d837064bf41b4
TLSH
T113F0AB3C21E7010EF2B2D6BD07C147864923F13321082B6D3AF0030D1D0AD807DA191B
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\1UDHZB\Chrome\fingerprint.json
Size 970B
SHA256 b45cbd22f3b779679e6faa317a298f828505490f2eb5087fbd21c4df459ef4d2
MD5 ae9413581d8680353337b30377d8e99d
SHA1 b0379e8639b10ccd1bf2dc35888e83c2a7b282d2
SHA512 1553f37246c6e9cb6d264af1a8f0f0c7bde085eb5fe1f0f281c7e5fefa2ae16c6caf835961f2670a9e264219dc19a07f130f14e190f4be98656427cc7a0c0ca9
TLSH
T14A114002A815D4BF2971F058D23044473AB14F2D32B90C1733FB642C155A73E311AFA2
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\1UDHZB\Edge\fingerprint.json
Size 969B
SHA256 8c85ed9b08ad410aabe20f0aa1458c77a957048a5309cd9b5710e48e74cb53cd
MD5 9035d185e4e01300b22bade6f330976c
SHA1 37b8fdad6006b4efd3dd9adcc2cd90f7aa9fda61
SHA512 d675b8621a2ef797fb58542f31a306c4e38569cbedf990c8253ef272ed0608c1d7b17aa487dd28a86485d146cb33d4e7a79d935352263a77c2858b4e304932da
TLSH
T1461104219415D0FF7A72F468E678481733318F5E71B90C1735FB942C285277A211AFE6
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\PqLUZ6\Chrome\fingerprint.json
Size 970B
SHA256 581c685edea8a7f45b4b0d1012574bfcf4eaf2f534eb3776d7e0e7c289a7b90a
MD5 9b0b6738e4cea6092204701b3451e02a
SHA1 066dbb5828763863e8e7c58f21a364675794c284
SHA512 ca95391c15555da41c8fc2c22948ba8f9f4c3111d563cb766429f55b630f1ddcf751d3a9ba79aa68d16cf566116c55f9696c15b2a639885b6c483bbc9896bb15
TLSH
T103114002A815D4BF2971F058D23044473AB14F2D32B90C1733FB642C155A73E211EFA2
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\PqLUZ6\Edge\fingerprint.json
Size 969B
SHA256 5a96d271a7d80c00693bc614a625f67b586c8fe158aa2fbbb122c79bdf51bef7
MD5 ed677ea3cd2e5b97f6098f21c04f4bb7
SHA1 34a5b98b7aa8d0bbf93f4d97c7d8b9c2d513a779
SHA512 95190218d9c1b9be88553308786a250b4f1a9a37c7bb823c9d19e8c5138ad4d571e8fc68f5893d2d912669f4fac4ed245f8b6ed5428624a0b514a45ecf63bd72
TLSH
T13C1104219415D0FF7A72F468D678481733318F5E71B90C1735FB941C285277A211AFE6
MD5 SHA1 SHA512 TLSH

Submit Download

SumatraPDF-settings.txt

Path C:\Users\Admin\AppData\Local\SumatraPDF-settings.txt
Size 2KB
SHA256 71fa07dfd2cbae23a880630604680112b3766c5a43f94cb9e2f0828f8f70e2e5
MD5 3ab750236ad42ce212d0a5e9378e46e4
SHA1 33d26a067d0a1618a84df982941364ef442a88da
SHA512 59d19cd118f4707129029178f0e6f1abbfc9bb16bc69b59b6e960468b94840767a88937b53e66dcf4d16cbd982162d1f58bebc08d39af07ccca087f8c4e211dc
TLSH
T13341CE2C255B603CC926775DAEB7E0334EE63860719B7998B9EE581C345096C819DD0E
MD5 SHA1 SHA512 TLSH

Submit Download

UxTheme.dll

Path C:\Users\Admin\AppData\Local\UxTheme.dll
Size 220KB
SHA256 20471a44987c563b0701f18e5fa20b797fe046674f67563c8904b9a90e056394
MD5 019b1572141a19a705df8b7f9c69cb4b
SHA1 d7d7798b17fd584cd4726c292e53a70a0f37f2ff
SHA512 78d257770b559402c8e64db82d64ea5509a0d126281af5be88ec05bd878c7f63559a0fbc26f745c0527d9ce5e2be3144d7498487902fef2684a1b807074962bc
SSDEEP 6144:PAskkjLGeh/c+5MZkaVYmcXRBkDKyLh8dUFZzk/zlpePF:PAskU/vjaVYmoRGzUUFeLy
TLSH
T10524126190D17539E8B906BC18C53374ADB0AC952AAE42CFE53AFB72193035C9673BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Xwb9PT\Chrome\Default\cookies.json
Size 341B
SHA256 497ed0912a1dff680cbbab05f2a0bb9e330969a36fb2e341d8009f6f24226b17
MD5 fae360b4f64f1c490ced17f4f64dd796
SHA1 f3d9bf641c571737595b50b43ac8deceaad421c3
SHA512 25e2c3f63ecd3391bb9d164108c6c4d11778990f8e2a147c1d14baeecdde21f16a0a71975549443761b0efe7dbc7154b7f877d465ca7c78791db44ff1f243e4d
TLSH
T1FBE0C082D5921C1ACE44D6A94D801BE8AEA1174142BECD6E601EC4806D21981265BCDD
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Xwb9PT\Chrome\Default\cookies.txt
Size 253B
SHA256 ca4f9153d182d2dc15530f1e15b55dfdeea1ae60ba1a4f5294524999f61d5b2a
MD5 367df57c912993e93cd6e360f7e3e135
SHA1 73e79e3bb65f2fbb80a3c42eb879080289e4a374
SHA512 8244a366cae9769ce2d0abaeea14c4ca27f4a38c2ee416eca1dd24f3a79b5b4c40b81851a2e53c730b9a42698726677e641cb5401662f44e73b6c21277db3700
TLSH
T1DAD0950297A61D8AC71CCA9549D416E4EFC317449377CE6E710D8090BF11D402DCB4F4
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\Xwb9PT\Chrome\fingerprint.json
Size 970B
SHA256 88c2fbbd640716dc314d07867e740ce506e29d76ee3b1b188f94cc5d704f7077
MD5 3b797050e9c59b598f183e2e12e811c3
SHA1 1717f937c49544194be48ba2d22b8b8fe92ca1be
SHA512 459eaeec4d135c395cadb980fb33067651ddc8469e478cc9d5b2e6c754b1be5935740bbc4fd95786373af6e074b68c8338c24392d92921b28a9961cd39e4d39e
TLSH
T1CB114002A815D4BF2971F058D23044473AB14F2D32B90C1733FB642C155A73E211AFA2
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Xwb9PT\Edge\Default\cookies.json
Size 343B
SHA256 b7e55ccf30a6f7f0ca37e66d2502dc918602a7ee166615c19eee5bc6106e32dd
MD5 c1dcf66269c1a89565c1c5d20641ccde
SHA1 7f850b1cfa2f7b079e82031adc571173f1f8222e
SHA512 1069da6d8c114e7792ec89fbe4c29e0292bfefcadc19233df30701487b30c38b197f7836ae9ff56f74a8589bbeeefbd56cf5d2ac8c64f058e3c02f41b8e14e33
TLSH
T166E028DE54614876EE05C4266C509B4E95143DD58990CC3CBC97D5AC695214C23254CE
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Xwb9PT\Edge\Default\cookies.txt
Size 255B
SHA256 17f588a55e22da1b042ec81f75fe31c522790a5b4f57f1b711991df81936db91
MD5 82f1b41d80eb145db7b262511da3a7b4
SHA1 5c95ce100d54cf7ccafc83909acf31bf5385ce30
SHA512 989c9ed50ec009c19189a658aa38b14c7abcc3e871bb57003647dd4279f43b92ad14f69a9c135bbabb5513cae1a4bfc3c7ab31a2c007dd7dc946a3211bb72eec
TLSH
T167D095DD9970D1E63704C0057474C71F85003CC5C461D53CBE59E0F8755310C57155C9
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\Xwb9PT\Edge\fingerprint.json
Size 969B
SHA256 88a365bae9bd7e4df2e45a2fca3d3098e614cbdf08cc12ab3139448b6f53991e
MD5 272c5986be181465a03321ad694d881e
SHA1 2bbc52c50d1f2f39422acf9f29bc2596e59ba38c
SHA512 d31e6af254d81ad21fe65d0934bd12e82282a176f0f5db31ad50a45ef91238f3147887feee9366d101f134750096acd0d0a3506d2f29e045402a5b8f6980c972
TLSH
T1111144219415D0FF7A72F468D678481733308F5E31B50C1732FB941C285277A210AFE6
MD5 SHA1 SHA512 TLSH

Submit Download

demo.exe

Path C:\Users\Admin\AppData\Local\demo.exe
Size 19.4MB
SHA256 719f689b34f47be8ca105ce8484948474dafde0e106bab599e4a89326070c3d0
MD5 79435213ab241b13a9d8da354c088868
SHA1 6232326f3da33c340c57e7370e038085d5f86d88
SHA512 1fe4766426e145aad9215830cab225cdf9151de23fe56877654aa5b84bb8af65486a8a0d8466b3f8cbeaea32baa6c5ffe04347893e945085a73a3a85e5f969c1
SSDEEP 393216:rcwPySz6s9X5xZ08RBCxXJq3o4I5y/+uuPZ:L6s9X5xZ08RBCxXJxd5yGuuPZ
TLSH
T1FC17BE96B2949AB8D542FA3CC911827EF229FC2C5B61834741D97D747E733680C29FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-161-0x00000000038E0000-0x0000000003A7A000-memory.dmp

Download

memory/2904-18-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-52-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-49-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-46-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-44-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-42-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-54-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-47-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-41-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-204-0x00000000033F0000-0x0000000003555000-memory.dmp

Download

memory/2904-0-0x00000000023E0000-0x00000000023E4000-memory.dmp

Download

memory/2904-17-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-165-0x00000000038E0000-0x0000000003A7A000-memory.dmp

Download

memory/2904-166-0x00000000038E0000-0x0000000003A7A000-memory.dmp

Download

memory/2904-48-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-156-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-45-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-16-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-14-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-37-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-34-0x00000000033F0000-0x0000000003555000-memory.dmp

Download

memory/2904-7-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-6-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-8-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-9-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-15-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-13-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-12-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-43-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-11-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-10-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-1-0x00000000024F0000-0x0000000002545000-memory.dmp

Download

memory/2904-50-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-51-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/2904-53-0x0000000003870000-0x0000000003A0A000-memory.dmp

Download

memory/3692-75-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-102-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-104-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-105-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-107-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-108-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-111-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-110-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-100-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-99-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-112-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-109-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-106-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-103-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-101-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-95-0x0000000003570000-0x000000000370A000-memory.dmp

Download

memory/3692-79-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-70-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-71-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-73-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-72-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-74-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-77-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-76-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-78-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-81-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-82-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-80-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

memory/3692-65-0x0000000000980000-0x00000000009D5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads