dridex | 8a46a34e29b23a7f6b1b7f1094249ecf471497859561d3161f3e0ea060d4d40f

Resubmissions

04/08/2026, 06:28

260804-g8a3ssed5510

30/07/2026, 16:02

260730-tg3d7a1hna10

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
107s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a46a34e29b23a7f6b1b7f1094249ecf471497859561d3161f3e0ea060d4d40f.dll
Size 1.1MB
Sample260804-g8a3ssed55
SHA256 8a46a34e29b23a7f6b1b7f1094249ecf471497859561d3161f3e0ea060d4d40f
MD5 f78aec90e440b167158c7568ca56f8d5
SHA1 e6677c380ada56d32cfe59b49c8b668a2748a751
SHA512 83527a6bdfb0e7500664520c803905f117341be25d4713f5e1538bb6bf24693854d686e1fbeb2cc1b004ac36b4871458c9bc33566e03ff2ba7f4bd3461617f3b
SSDEEP 12288:jBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:d/nts0Q9K/0ooRQIxAk2wi0N/
TLSH
T10835CF86869A9BDCC7F99378D0BC0A753C6C7CEF8434E5CC979442890E1E609CDA16F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet defense_evasion discovery dridex payload persistence trojan

Malware Config

Signatures

Family: Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral2/memory/5360-3-0x0000000003630000-0x0000000003631000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

resource	yara_rule
behavioral2/memory/4816-1-0x00007FF80C660000-0x00007FF80C76D000-memory.dmp	dridex_payload
behavioral2/memory/5360-37-0x0000000140000000-0x000000014010D000-memory.dmp	dridex_payload
behavioral2/memory/5360-48-0x0000000140000000-0x000000014010D000-memory.dmp	dridex_payload
behavioral2/memory/5360-30-0x0000000140000000-0x000000014010D000-memory.dmp	dridex_payload
behavioral2/memory/4816-50-0x00007FF80C660000-0x00007FF80C76D000-memory.dmp	dridex_payload
behavioral2/memory/5440-57-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp	dridex_payload
behavioral2/memory/5440-62-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp	dridex_payload
behavioral2/memory/3724-77-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp	dridex_payload
behavioral2/memory/2580-87-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp	dridex_payload
behavioral2/memory/1876-105-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp	dridex_payload

Executes dropped EXE 5 IoCs

pid	Process
5440	recdisc.exe
3724	WMPDMC.exe
2580	WMPDMC.exe
3696	consent.exe
1876	cttune.exe

Loads dropped DLL 4 IoCs

pid	Process
5440	recdisc.exe
3724	WMPDMC.exe
2580	WMPDMC.exe
1876	cttune.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mkxggar = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Outlook\\jv\\WMPDMC.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WMPDMC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WMPDMC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cttune.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	recdisc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4816	rundll32.exe
4816	rundll32.exe
4816	rundll32.exe
4816	rundll32.exe
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5360	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found
Token: SeShutdownPrivilege	5360	Process not Found
Token: SeCreatePagefilePrivilege	5360	Process not Found

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5808	msedge.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found
5360	Process not Found

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 2068	5360	Process not Found	89
PID 5360 wrote to memory of 5440	5360	Process not Found	90
PID 5360 wrote to memory of 3600	5360	Process not Found	91
PID 5360 wrote to memory of 3724	5360	Process not Found	92
PID 5360 wrote to memory of 52	5360	Process not Found
PID 5360 wrote to memory of 4052	5360	Process not Found	95
PID 5360 wrote to memory of 3696	5360	Process not Found	96
PID 5360 wrote to memory of 5504	5360	Process not Found	97
PID 5360 wrote to memory of 1876	5360	Process not Found	98
PID 5360 wrote to memory of 5808	5360	Process not Found	99
PID 5808 wrote to memory of 356	5808	msedge.exe	100
PID 5808 wrote to memory of 1536	5808	msedge.exe	101
PID 5808 wrote to memory of 1512	5808	msedge.exe	102
PID 5808 wrote to memory of 1512	5808	msedge.exe	102
PID 5808 wrote to memory of 1512	5808	msedge.exe	102
PID 5808 wrote to memory of 5348	5808	msedge.exe	103
PID 5808 wrote to memory of 5348	5808	msedge.exe	103
PID 5808 wrote to memory of 1212	5808	msedge.exe	105
PID 5808 wrote to memory of 1212	5808	msedge.exe	105
PID 5808 wrote to memory of 1212	5808	msedge.exe	105
PID 5808 wrote to memory of 1748	5808	msedge.exe	106
PID 5808 wrote to memory of 1748	5808	msedge.exe	106
PID 5808 wrote to memory of 1748	5808	msedge.exe	106
PID 5808 wrote to memory of 3476	5808	msedge.exe	107
PID 5808 wrote to memory of 4740	5808	msedge.exe	108
PID 5808 wrote to memory of 3476	5808	msedge.exe	107
PID 5808 wrote to memory of 3476	5808	msedge.exe	107
PID 5808 wrote to memory of 4740	5808	msedge.exe	108
PID 5808 wrote to memory of 4740	5808	msedge.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a46a34e29b23a7f6b1b7f1094249ecf471497859561d3161f3e0ea060d4d40f.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4816

C:\Windows\system32\recdisc.exe
C:\Windows\system32\recdisc.exe
1⤵
PID:2068

C:\Users\Admin\AppData\Local\nwX\recdisc.exe
C:\Users\Admin\AppData\Local\nwX\recdisc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:5440

C:\Windows\system32\WMPDMC.exe
C:\Windows\system32\WMPDMC.exe
1⤵
PID:3600

C:\Users\Admin\AppData\Local\BSWoGzZK\WMPDMC.exe
C:\Users\Admin\AppData\Local\BSWoGzZK\WMPDMC.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3724

C:\Users\Admin\AppData\Roaming\Microsoft\Outlook\jv\WMPDMC.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Outlook\jv\WMPDMC.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2580

C:\Windows\system32\consent.exe
C:\Windows\system32\consent.exe
1⤵
PID:4052

C:\Users\Admin\AppData\Local\LnfYIA\consent.exe
C:\Users\Admin\AppData\Local\LnfYIA\consent.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\system32\cttune.exe
C:\Windows\system32\cttune.exe
1⤵
PID:5504

C:\Users\Admin\AppData\Local\XoUTD2At\cttune.exe
C:\Users\Admin\AppData\Local\XoUTD2At\cttune.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff80678c188,0x7ff80678c194,0x7ff80678c1a0
  2⤵
  PID:356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,4998154399801002746,14302462506845900959,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,11682730840846425473,1059253459932161134,262144 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,570675846048332506,9614414023985820708,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,14096413254246595634,563397438539368033,2097152 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,7120674933195676617,9809799168288530990,2097152 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,896160749269136861,1352382514029930041,2097152 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,10139032967013926402,11390952206885526593,2097152 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,904847558128623569,15451158083998880184,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15687574834645938925,5817207153929042411,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,3260946468927053614,14035263772917561710,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1271974508891720571,9957635208857694542,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1271974508891720571,9957635208857694542,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13870853026528045764,5181909002458777122,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,15389881404276513089,5907920697951130620,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,5743453107467675200,8987581089908058206,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15355526812421746940,4526819721319079617,524288 --field-trial-handle=2344,i,18272136656428562119,1387630635759044317,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UxTheme.dll

Path C:\Users\Admin\AppData\Local\BSWoGzZK\UxTheme.dll
Size 1.1MB
SHA256 5b6c59e35a1e4e4911a47244feb21bbd9ce7fa7ecd0e5a794bdd1f77c340b64d
MD5 e41c64dd42a52d934ee97407f592fe03
SHA1 0be1d840c70bef5ad697ba1a7bd06a704a751a6f
SHA512 adf5d75c74c7152b48da345ee9479259020855f2ba9add73036bd624a6451d096d3f2e6a8bd9e766983fe7d9968fc3b85d91952a90ba1716bcdda4db0af4e7ff
SSDEEP 12288:0Bim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:Q/nts0Q9K/0ooRQIxAk2wi0N/
TLSH
T1EE35CF86869A9BDCC7F99378D0BC0A753C6C7CEF8434E5CC979442890E1E609CDA16F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMPDMC.exe

Path C:\Users\Admin\AppData\Local\BSWoGzZK\WMPDMC.exe
Size 1.4MB
SHA256 3820e33c443c9c3f0cdbafcb108e24d9862ca716d05de5f894360eb0751b78f0
MD5 0a79551d568925fc3944f2cb4ef386ab
SHA1 3336d26ae7e6d43ac8295c1064cd0fe6ab3a7f60
SHA512 c66a2d5d9f5d2e69d2b6676c95521a5dacee1e9568a27d0eaae9c5365479aecd83e054bf67c806108890d3cc792dbf633e7d91a3ff9a58aece51191c3db4f9ab
SSDEEP 24576:OJSM/zWZ++FyCAJYQ/pZER6yg9MYR8sUXqTSYzSmgHVJZh/u:OJ3E+4JAPBCRXuMYR8sUXZYFgHVU
TLSH
T18B657D5DE2E840E5C679927CC552838AD6B2FC10172287CF226442BFAF73AD55D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

consent.exe

Path C:\Users\Admin\AppData\Local\LnfYIA\consent.exe
Size 217KB
SHA256 d113a72e322e1c16f204bb1662d035bcd27ce4bffa6f48df166eeb223b6c947d
MD5 3e5a93624024df18684ef01af7da1db8
SHA1 57d09161b8240e8fb00be1db9c43dcfc6ad3adca
SHA512 2593e91018dc515215b615fd746da0f72a3851ba61f1c6fba00929d5185609d3fc6dbd558779b7a3cc48d375dcba54591c082cb725a3ca1f620b50cdecd7b53a
SSDEEP 3072:iDtxeuHpL6ExGSNo+TFvH5k/+OLvFvz5WEJ9K:StXpL9xGyoeO1LRzMB
TLSH
T19F24162A72641084E32983384142E291AB717C3C1791A7DFD6B4F9395F336D7AD3BA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ff053122166417a22c769259e8644253e8af8c787b3c633beb1c0c7a810d3775
MD5 69572dec503f07878154c1eca998494f
SHA1 a4713a3ac961578893b2ce6f5b2f97a4c38b5ea3
SHA512 312a5f9262c0dbce033805d1f0a583110f1fff9835fa78f179791a0231f34b3a218d832da84e475224455aa58b4fe31433b968b87c8c6847ea1b1eff21009737
TLSH
T1BB219DF3C3E8567D894181F866182E1BCE2D0955832C3E5AC9D4AB5BA3E18B1E25095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d1785def5cf0c69d216895f92190241566a70ed32284f7748b1eb5619d065ce4
MD5 bc6757c052e46529b2785f496ad11faf
SHA1 de0387589c5afcf30db01c7761da075b63387531
SHA512 1d4c20046f4c3c86d5271869fefb0c56b15865505d0177c8e2d091d73e73d36c7e9066e6b6835edd79f2cec8cb29b4f084fd789b21640f32f38a0cc346613577
SSDEEP 384:sxRqsO5/fFsNulTsmF30qSIX/5d/ovS1y:suT5/fWulV3BSG/5huSQ
TLSH
T1D552E7066E64A83B5CC7D259BE16BF53E6FC5032A1D49E58F6FC9A4C04EA6CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 1050a0a9d9c7c7d8805e7fd61f9699cbb962d17938a0a9ba27f2fb0a970be980
MD5 e2639769fdda4ae22d4368fc757de6e0
SHA1 bc3c4af91a41a571d70688dd409ec7fc3789984f
SHA512 89c5fafd18d53d210cbb84fc38c8003ca1bfbcc2289759edb14a707284cee933a69a87f64a9b4530b3600156bfc7a5ac9dfe90a8842f216b5dbccae1838f8c11
SSDEEP 768:azfWQd7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtAYc16+ropQZY0:azfWQLEf30Wg/XfHfu1jaeAYy6VpQZ9
TLSH
T1FFD2EA7B640CCA7F4F800ADDAD197EDF6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86055de1-2017-44e9-a734-259e565d0856\index-dir\the-real-index
Size 480B
SHA256 000ec6d65a94212b5f540ef611e569863733441dd3389d626bd2a2c58287b04a
MD5 94a7df25c2927eaa27c050cb06d03625
SHA1 b7bb50b34ad0bdba31e78a19e55ee96f9a52b1f8
SHA512 e5478b98bf9c620b0dec3349a0c4e139fbd47a5b097a79eacb1a7c1c06502a6258d388caf9cc2fb4d96f231b3d96b21a6838b9af0e3dc645592e4a8d15d043ec
TLSH
T1A1F0C0ABCC71B483C93278FA15371906333A03FE321ABD66006D642DDD1163C4280345
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b0c22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86055de1-2017-44e9-a734-259e565d0856\index-dir\the-real-index~RFe5b0c22.TMP
Size 480B
SHA256 4c5263abcd0651acd6c84a7bc1eed66582e4e87b77dc22fb02ff3800bbb9f7bb
MD5 5bd9e146aa1c5352e62bc5aaf553326b
SHA1 777b05bef95c9d6e5f1d69f845950db443fd7bb9
SHA512 b67a70be6e7975d940a003d083460191a1e90ab20e9ae72abb5ab3ea7bdb8abe2e9fa078fe850a7f27ed78c82ac7e86ab73b08e9b71fc9d6e1a6c2ea6d218af6
TLSH
T1A3F020EB4071ED91D91664F51546541A333F09353525E61B109E241E5D116788681745
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 57200a4a9f51f930a970ccd65a4a207506790f9c54e39030eaf7075260f04c9d
MD5 200637050ffa21359f50d7429b5152e9
SHA1 519b2fa2e84a186634cce02ff76b88b7d48e23ff
SHA512 36d7969e579ebc003dd74cee9e376696a20a4f7b45a54943205992af07ce7baa67f421e4916b45f3a91d1dcbdf58f3cf186646e390d7f3b06e0af8028737dada
SSDEEP 768:rrv+4UNbdS3Wmi0KUrEnjN3Gac1ZJeVH1SCz:rbsbg3V/QnjMayEH1V
TLSH
T10503CF3269A89EB38CEBE385B14776037FB4125385940BE0C6DD7B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dcbefd445059567d8d75ecfcf00986f43c15e99567f51dfff2c0967ff2d3a299
MD5 159acfb772101d6af1a858b17e5c59f1
SHA1 a24b541296654ef64b0324997c1e86733a85dfc0
SHA512 93f1cdae7d5896943bdbc82984fcd571ca208227fda34ace8b75ff1b830175f0646ac6c0a870d5da673dbcec3530f692bb2783e647fc4868d6fa98498d37045b
SSDEEP 384:zMsrv+89zHqlDNP9oidS38NoET02gf8GWZlf8hyEGoH77jaFhy2rEoajo4cdR8eT:7rv+4UNbdS3TU3i0KirEnjN3Gac1FtP
TLSH
T1C803BF307968DEB38CFAD285B147B643BEF416A388C54BA4D9C97A4C05875E9270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d767c7a3-faa7-4e8f-98c1-7f4d9fa68f9e.tmp

Path C:\Users\Admin\AppData\Local\Temp\d767c7a3-faa7-4e8f-98c1-7f4d9fa68f9e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5808_2134390986\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OLEACC.dll

Path C:\Users\Admin\AppData\Local\XoUTD2At\OLEACC.dll
Size 1.1MB
SHA256 4066595be3c8aab46e09d4eaa13ee2ca0ff7f92a9eae719d9a0c2d57cc1b8d1e
MD5 6cc031c916204037288b45cbd5282c51
SHA1 a27e8691c1240cdb2d8a29b50fc38e0eed24827e
SHA512 1afd3b1d52bba0c5ec759bf06bc3d0e0fcb47ea2dcdf4f6767a3cc98d703f3333a7f706267c70fec7ff03ecbeaaecefbe11db61ad5ec34e102aff869d53643c9
SSDEEP 12288:pBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:L/nts0Q9K/0ooRQIxAk2wi0N/
TLSH
T10835CF86869A9BDCC7F99378D0BC0A753C6C7CEF8434E5CC979442890E1E609CDA16F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cttune.exe

Path C:\Users\Admin\AppData\Local\XoUTD2At\cttune.exe
Size 112KB
SHA256 ed5e10ce65092374571125fefe919cc9f7444b208f7bd2444f047a0dabf57957
MD5 226f57990f9a4c32120efd0405d84b70
SHA1 2ea26c9fbc20f2f81c9ced9f908cbb6d01b0371e
SHA512 19fa36744d7ad2e4aa017c20233062b276d02d3f301c40ff2234c29a6f3666c76c44eb08735acc02f3eb41ac94bdba1cdcfae54c05b37c5d08367d09698de4df
SSDEEP 1536:OPZB4ffDkyDPmtMQVfOomfTyaSlQR9CV/8ws9dEoC0tueIEo7jc+a5DA9jU4ZE8L:OByDPsp2gSCVkBdELU/vpDA9oSjp9
TLSH
T1F3B3191C62B931F9D566923C8656462ADB767831272263FF03D0C5B8CF27AE53D39E01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.dll

Path C:\Users\Admin\AppData\Local\nwX\ReAgent.dll
Size 1.1MB
SHA256 c17d6f880fc39c2ec8b6759c27ba2775b17f0993ef132df319695e5e2bbea2a9
MD5 c13d9b8f0112b5de1757ba88ea66e2fa
SHA1 cc2fb515b9ab55d44c7f5c5b6f7f4ad000669ea5
SHA512 e0881a2d99071a0a211dc9ef6ab459d9d89a2f2ed5a1acc45250e26e42088dd0e03a4680bfd870c2952cfad167114f00da228224d174df62c490facf2dd74cea
SSDEEP 12288:JBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:r/nts0Q9K/0ooRQIxAk2wi0N/
TLSH
T12835CF86869A9BDCC7F99378D0BC0A753C6C7CEF8434E5CC979442890E1E609CDA16F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recdisc.exe

Path C:\Users\Admin\AppData\Local\nwX\recdisc.exe
Size 212KB
SHA256 8bf1b29360084ddeca99685676e58f6ed8a211c9d97dc4f38ab520907d1738d5
MD5 495d7e837ad394fd0f797dce0cfd20b4
SHA1 79ee0ef540f6d117709d46afb65b232e0984f1e4
SHA512 3152d0bd7ce93794addd383f009b87f090c237dfba5d98c3c0807559086d17538c7832967f20684f0af76cb9356a633abd463ab833286aae3d7afdcb6f6256c8
SSDEEP 3072:i5jX1FjfF7DJbJX6xBdN75eXBjE5CAuegPO8evTq2V3:i7HX2dl5eXB6CFegEv+2V
TLSH
T1DB246A0A72B462F9D2A9C23AC5526665EB713830572243DF06E0C57E0F16FF1AC39F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Smjipjomc.lnk

Path C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Smjipjomc.lnk
Size 1KB
SHA256 246536f3c7a11518a918adc85710d91972cc9c5cfbc7fec59510e853d0fa26bb
MD5 05d07719fb22e2c31e0b6894944239d3
SHA1 f6e17819c02b1162a9c6d79878feea7241fd54bb
SHA512 a376e2d759e8136933c07afc1a12d1733c6f8e5f5a8cab0926fed216b8f0286ea7ccafa4eb5bef0a2cf77efc3462f8c9fddec8288c6b7bf8f92d0e02c0afeb85
TLSH
T16031FE4D88C50F0AD2FB5E3721B72231DB7AFC45BAA2D70C5254408C1A80A11BF5873F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1876-105-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp

Download

memory/2580-87-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp

Download

memory/3724-77-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp

Download

memory/3724-74-0x000001C4FE990000-0x000001C4FE997000-memory.dmp

Download

memory/4816-0-0x0000023DF6790000-0x0000023DF6797000-memory.dmp

Download

memory/4816-50-0x00007FF80C660000-0x00007FF80C76D000-memory.dmp

Download

memory/4816-1-0x00007FF80C660000-0x00007FF80C76D000-memory.dmp

Download

memory/5360-23-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-19-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-8-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-3-0x0000000003630000-0x0000000003631000-memory.dmp

Download

memory/5360-13-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-28-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-11-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-12-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-14-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-15-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-81-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/5360-18-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-17-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-22-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-21-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-25-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-29-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-30-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-16-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-6-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-20-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-38-0x00007FF8286B0000-0x00007FF8286C0000-memory.dmp

Download

memory/5360-39-0x00007FF828930000-0x00007FF828932000-memory.dmp

Download

memory/5360-24-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-291-0x0000000006B20000-0x0000000006B21000-memory.dmp

Download

memory/5360-26-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-27-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-5-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-7-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-48-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-9-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-10-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5360-40-0x0000000003120000-0x0000000003127000-memory.dmp

Download

memory/5360-37-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5440-62-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp

Download

memory/5440-59-0x0000025B45EF0000-0x0000025B45EF7000-memory.dmp

Download

memory/5440-57-0x00007FF810EA0000-0x00007FF810FAE000-memory.dmp

Download