valleyrat | 194845853f864088bc9fae5c0b2f692f6d6b1564f41111041247b3f86d356f30

Analysis

user interaction
yes
max time kernel
600s
max time network
600s
platform
windows10-2004_x64
resource
win10v2004-20260513-ja
resource tags

arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
-A2026804002105.zip
Size 4.0MB
Sample260804-w3tehsxdkf
SHA256 194845853f864088bc9fae5c0b2f692f6d6b1564f41111041247b3f86d356f30
MD5 2eba26f01155a443a3924b45dba0639b
SHA1 1ac8d260ecc57999531dab27cf1c07fd92eb168c
SHA512 13e28844416dfb629f10879e9d0ceb6d8e57487ffdd09df1194ee70776d4c7ce3017a20969a4af868e31f5f1735c26b9a5154301f139807ab69edfe48977148d
SSDEEP 98304:6xP4M/QQ38TSOsK+/UfyoFfeLOALt9+Q3k2uuy8ct2BsNpQ2j++:6z/18TWK+sfy6MjLrH02uuy8ct2BP2jp
TLSH
T14E163353C0387EB2C2CCB37162E2D9C96099D551C0B2E8B3F277958F9CD69522E6B44B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution valleyrat

Malware Config

Signatures

Family: valleyrat
valleyrat

Windows_Trojan_Winos_464b8a2e 5 IoCs

resource	yara_rule
behavioral1/memory/3896-39-0x00000000040E0000-0x0000000004138000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral1/memory/3896-40-0x00000000040E0000-0x0000000004138000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral1/memory/3896-42-0x00000000040E0000-0x0000000004138000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral1/memory/3896-43-0x00000000040E0000-0x0000000004138000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral1/memory/3896-44-0x00000000040E0000-0x0000000004138000-memory.dmp	Windows_Trojan_Winos_464b8a2e

https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 6 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024489-19.dat	WinosStager
behavioral1/memory/3896-39-0x00000000040E0000-0x0000000004138000-memory.dmp	WinosStager
behavioral1/memory/3896-40-0x00000000040E0000-0x0000000004138000-memory.dmp	WinosStager
behavioral1/memory/3896-42-0x00000000040E0000-0x0000000004138000-memory.dmp	WinosStager
behavioral1/memory/3896-43-0x00000000040E0000-0x0000000004138000-memory.dmp	WinosStager
behavioral1/memory/3896-44-0x00000000040E0000-0x0000000004138000-memory.dmp	WinosStager

Executes dropped EXE 2 IoCs

pid	Process
3896	MicrosoftEdgeComRegisterShellARM64.exe
2316	MicrosoftEdgeComRegisterShellARM64.exe

Loads dropped DLL 2 IoCs

pid	Process
3896	MicrosoftEdgeComRegisterShellARM64.exe
2316	MicrosoftEdgeComRegisterShellARM64.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	ComputerDefaults.exe
File opened (read-only)	\??\B:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\L:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\M:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\P:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\U:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\K:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\N:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\R:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\T:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\W:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\X:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Y:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\G:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\I:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Q:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\S:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\V:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Z:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\H:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\J:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\O:	MicrosoftEdgeComRegisterShellARM64.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
60	api.ipify.org
66	icanhazip.com
67	icanhazip.com

Discovers running processes 1 TTPs 10 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1148	tasklist.exe
892	tasklist.exe
3028	tasklist.exe
2484	tasklist.exe
4796	tasklist.exe
4668	tasklist.exe
4384	tasklist.exe
3788	tasklist.exe
2912	tasklist.exe
2004	tasklist.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1988	cmd.exe
568	cmd.exe
2080	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4440	2316	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vat.N0.20260804110703.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeComRegisterShellARM64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeComRegisterShellARM64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Delays execution with timeout.exe 10 IoCs

defense_evasion

pid	Process
4348	timeout.exe
2656	timeout.exe
4396	timeout.exe
2904	timeout.exe
3040	timeout.exe
4480	timeout.exe
968	timeout.exe
2852	timeout.exe
4836	timeout.exe
1948	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1764	taskkill.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command	Vat.N0.20260804110703.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings	Vat.N0.20260804110703.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-3543054753-178125582-54464056-2469/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe"	Vat.N0.20260804110703.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell	Vat.N0.20260804110703.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open	Vat.N0.20260804110703.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command\DelegateExecute	Vat.N0.20260804110703.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLoadDriverPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTakeOwnershipPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncBasePriorityPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTcbPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	2912	tasklist.exe
Token: SeDebugPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreateTokenPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeAssignPrimaryTokenPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLockMemoryPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncreaseQuotaPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeMachineAccountPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTcbPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSecurityPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTakeOwnershipPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLoadDriverPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemProfilePrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemtimePrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeProfSingleProcessPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncBasePriorityPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreatePagefilePrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreatePermanentPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeBackupPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeRestorePrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeShutdownPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeAuditPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemEnvironmentPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeChangeNotifyPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeRemoteShutdownPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeUndockPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSyncAgentPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeEnableDelegationPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeManageVolumePrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeImpersonatePrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreateGlobalPrivilege	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: 31	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: 32	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: 33	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: 34	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: 35	3896	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	892	tasklist.exe
Token: SeDebugPrivilege	2004	tasklist.exe
Token: SeDebugPrivilege	3028	tasklist.exe
Token: SeDebugPrivilege	2484	tasklist.exe
Token: SeDebugPrivilege	4796	tasklist.exe
Token: SeDebugPrivilege	4668	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	1148	tasklist.exe
Token: SeDebugPrivilege	3788	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1920	Vat.N0.20260804110703.EXE
3896	MicrosoftEdgeComRegisterShellARM64.exe
3896	MicrosoftEdgeComRegisterShellARM64.exe
2316	MicrosoftEdgeComRegisterShellARM64.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1988	1920	Vat.N0.20260804110703.EXE	102
PID 1988 wrote to memory of 4156	1988	cmd.exe	104
PID 4156 wrote to memory of 3896	4156	ComputerDefaults.exe	105
PID 3896 wrote to memory of 1764	3896	MicrosoftEdgeComRegisterShellARM64.exe	106
PID 3896 wrote to memory of 568	3896	MicrosoftEdgeComRegisterShellARM64.exe	108
PID 568 wrote to memory of 2080	568	cmd.exe	110
PID 2080 wrote to memory of 2912	2080	cmd.exe	111
PID 2080 wrote to memory of 4636	2080	cmd.exe	112
PID 2080 wrote to memory of 4348	2080	cmd.exe	113
PID 2080 wrote to memory of 892	2080	cmd.exe	120
PID 2080 wrote to memory of 1152	2080	cmd.exe	121
PID 2080 wrote to memory of 968	2080	cmd.exe	122
PID 2080 wrote to memory of 2004	2080	cmd.exe	124
PID 2080 wrote to memory of 3524	2080	cmd.exe	125
PID 2080 wrote to memory of 2656	2080	cmd.exe	126
PID 2080 wrote to memory of 3028	2080	cmd.exe	127
PID 2080 wrote to memory of 4708	2080	cmd.exe	128
PID 2080 wrote to memory of 2852	2080	cmd.exe	129
PID 2080 wrote to memory of 2484	2080	cmd.exe	130
PID 2080 wrote to memory of 2096	2080	cmd.exe	131
PID 2080 wrote to memory of 4836	2080	cmd.exe	132
PID 2080 wrote to memory of 4796	2080	cmd.exe	135
PID 2080 wrote to memory of 752	2080	cmd.exe	136
PID 2080 wrote to memory of 4396	2080	cmd.exe	137
PID 2080 wrote to memory of 4668	2080	cmd.exe	138
PID 2080 wrote to memory of 1028	2080	cmd.exe	139
PID 2080 wrote to memory of 2904	2080	cmd.exe	140
PID 2080 wrote to memory of 4384	2080	cmd.exe	141
PID 2080 wrote to memory of 2996	2080	cmd.exe	142
PID 2080 wrote to memory of 1948	2080	cmd.exe	143
PID 2080 wrote to memory of 1148	2080	cmd.exe	144
PID 2080 wrote to memory of 384	2080	cmd.exe	145
PID 2080 wrote to memory of 3040	2080	cmd.exe	146
PID 2080 wrote to memory of 3788	2080	cmd.exe	147
PID 2080 wrote to memory of 2508	2080	cmd.exe	148

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\-A2026804002105.zip
1⤵
PID:4648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3624

\??\E:\Vat.N0.20260804110703.EXE
"E:\Vat.N0.20260804110703.EXE"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\System32\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\ProgramData\S-1-5-21-3543054753-178125582-54464056-2469\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
      "MicrosoftEdgeComRegisterShellARM64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\8821E12759AD7B6395C.CMD
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:568
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C C:\Users\Admin\AppData\Local\Temp\8821E12759AD7B6395C.CMD
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4348
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:968
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2656
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2852
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:752
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4668
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2904
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:384
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3040
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:4480

C:\ProgramData\S-1-5-21-3543054753-178125582-54464056-2469\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
C:\ProgramData\S-1-5-21-3543054753-178125582-54464056-2469\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 640
  2⤵
  - Program crash
  PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2316 -ip 2316
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\ProgramData\S-1-5-21-3543054753-178125582-54464056-2469\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
Size 3.5MB
SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
MD5 c185dbe4fcb5da174009ada3aa4822c3
SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
TLSH
T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFCore8.dll

Path C:\ProgramData\S-1-5-21-3543054753-178125582-54464056-2469\SystemAppData\PDFCore8.dll
Size 3.8MB
SHA256 f856bcab6dc2d2c4a047202d301f23b6b9e9ffe5ef5c85b5431bff69442ae95f
MD5 7125e2d1c3f52a4217adbe4140a1c36f
SHA1 08a9b79fd07a624aa9d74eb76059d2a89ba08bf1
SHA512 3f2537b9486cfbbe376c7d8d28315efb804713f061dc5f624b8705eb41a8be8d50ec082aca325f56c789477144da7bf0bb792bd3cce9598f9df04e81be54fafb
SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxLArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxLArDMxLkfIsEs
TLSH
T15006D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 727B
SHA256 dc2b74355ccbf980b546d102d07f62ae3754965fde8bcb1c9532efefe23f6066
MD5 c3c568bfd24897b041f3cb9d25451a96
SHA1 8a899b0ec566e3e215fadfe13d7979f0cd61aa40
SHA512 1dddebb74270f87e035cc635d43f360f0ff6f698d790342a3409138f929f3f42a30720df01c5417e76d26be738e3335031a2c31ab45b7d3922bb5da2372a9dc9
TLSH
T1830194D30A5888D02E248E0465F4B45335EAD01435FF6ED72929498F22EE378D8BE458
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
MD5 2b5a8554c5d49029302e9f94d82f4f89
SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
TLSH
T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
Size 727B
SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
TLSH
T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 895f3912ab7d818c60f98dfe7195fdcc1d1544a4eec908350eac31e7bf0fbcdc
MD5 89bddf9601cbb5370e6a637f6fee4b1b
SHA1 ab00f9b883840df145e17395a40a3b029785a66f
SHA512 aa06f3ea4f0ac3f519574b4bb4828db97cfb7fc6194243605fed3cb97f9e6c6d327fe5130b72fffc48aa5e1b7edfb2a137b14b878803fec508e9ecd9aaf71992
TLSH
T1220199834DD09774340019098BEDC070769E405F7D850795B7A8145B42F7467C183D0D
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 727B
SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
MD5 520b189a6d3e6f328898d98bb7105d6f
SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
TLSH
T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
MD5 SHA1 SHA512 TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 400B
SHA256 27e304bb82e83fcc51f8cd3789fd02b113fda127841cea148e86e0e54725e7a9
MD5 6d31a5dc8d4bda0aefedd2e4aba2bcbf
SHA1 b363f31adc7120291eb6305eb03486777e14de57
SHA512 c33f2cd5202ac0d5b521f46be13218e7feeb0ed14ad3c2509a68c494d1b405a0f049bba1b099e4ef794737af55780ee3ac03946cefc74c55b76b38e788f1e1f7
TLSH
T141E028242FF5003DF356C9764FC174574C0FF24A9844C7E00F90860C9B06F000D524B4
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 bc56547c9dc8fffb1a2ac8c8271f6308385576ff66d222e4a9d867d7ec4dd032
MD5 0c586334a54e6568c955962b57664d50
SHA1 37b15475e0421d2dcabca0a49736082ff07d50be
SHA512 e861c87efd87dfa9c85d973105972aa4fed8b4d8a8c26495301a65d05d0017a8c9d2beeca32d6d17edd0ed1615dee249f430f15e2549a6437e44a93111d456ee
TLSH
T182E0D82026FB502FF1A85B7403D990995B25F1126C5556AE1E91182D5919A014CA2831
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
Size 404B
SHA256 e205f4d9120f9bee20c7a6401b57f6385ef57d812fcd660c4f0f3f2f12d76e28
MD5 7028b9cecc46da047a207d2437af4104
SHA1 cf3b62a9a6b0947020127403e2592ef03f2b038d
SHA512 a9191423a0c60c672f48967df0b41a21effcd0ee4ebb7604034edd4bc2f1ab74b445de474530b1f6eee15b6b8d899d2b45b012de7959140e663fa24113ad2446
TLSH
T164E0283032FE011DF1F4D4381BE9AD215979F10B0406C3F9051447156B107004CA1131
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 47db263be5f7a01814777518ebe6ff8495095c84f2c214783de64e9dce56b16d
MD5 e9d6e3020f0536f0430b6041bed1047d
SHA1 2b94fe39e20af5bab941bb860ac64f337e0b1e18
SHA512 d9c5f958519af01a0a235767bc40bb4f6087bc7fe0e0e2236b0197c9bb2159cb2269c274d64d960ff54e1d091ed802409728b91d12d6cb54b37dbc63646e52fc
TLSH
T117E0683816EB641EF1909E3186E9A0760E6AF2056400E2BD07D14318BB1EF015E109F0
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 416B
SHA256 7d804e344ccb91ac7e0b62083605424abaf8801b90eb0b900a6514c7dc934689
MD5 74bbd0578400babdf2974375564edfb6
SHA1 2926726f4cfd9e649c5a076589a7b459b10cff82
SHA512 d3e648c49eb65fe01d74c3c7cff10d761d71d3a541572868ef90ee795b7425b0c51287334e2e5a0d9096feb0ff8c554187d3b751a59759b044a49bf3f38c7f9a
TLSH
T179E0683812BEA21EF020D93007FDA8315D18F305040482F80AD0435C6B17F005C11AB1
MD5 SHA1 SHA512 TLSH

Submit Download

8821E12759AD7B6395C.CMD

Path C:\Users\Admin\AppData\Local\Temp\8821E12759AD7B6395C.CMD
Size 1KB
SHA256 793ca9d76f158bb4ecb83c2e5c2038c54e674120d73de0397a0038be0f88e9f7
MD5 28b8ab97c322bf3362679c312cffabc4
SHA1 b08608008ad8aaadfe6451105455be0053b49199
SHA512 3874afd870d08d2a2e81ba32652a4b795e9f79a82981dce7211a7e798540bc713433eae9b92aecda57d10c3848ded4fa9b259be753cd3d6e444db63654542f25
TLSH
T103311B8EC40B4E0D431542DF225ADCAAC680E087FD843180B2AC5B802382E8A09A6BAD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3896-39-0x00000000040E0000-0x0000000004138000-memory.dmp

Download

memory/3896-40-0x00000000040E0000-0x0000000004138000-memory.dmp

Download

memory/3896-42-0x00000000040E0000-0x0000000004138000-memory.dmp

Download

memory/3896-43-0x00000000040E0000-0x0000000004138000-memory.dmp

Download

memory/3896-44-0x00000000040E0000-0x0000000004138000-memory.dmp

Download