hxxps://www[.]resight-cheats[.]net/resight-v3[.]zip

Analysis

user interaction
yes
max time kernel
56s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.resight-cheats.net/resight-v3.zip
Sample261002-lyxk9sysfw

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	resight-v3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	resight-v3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	resight-v3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	resight-v3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	resight-v3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{23463E6F-B6DC-40D7-AAD7-E2143EF7A97F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	resight-v3.exe
2356	resight-v3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2192	7zG.exe
Token: 35	2192	7zG.exe
Token: SeSecurityPrivilege	2192	7zG.exe
Token: SeSecurityPrivilege	2192	7zG.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2192	7zG.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4348	2128	msedge.exe	91
PID 2128 wrote to memory of 2900	2128	msedge.exe	93
PID 2128 wrote to memory of 744	2128	msedge.exe	94
PID 2128 wrote to memory of 2236	2128	msedge.exe	95
PID 2128 wrote to memory of 744	2128	msedge.exe	94
PID 2128 wrote to memory of 744	2128	msedge.exe	94
PID 2128 wrote to memory of 2236	2128	msedge.exe	95
PID 2128 wrote to memory of 2176	2128	msedge.exe	96
PID 2128 wrote to memory of 2176	2128	msedge.exe	96
PID 2128 wrote to memory of 2176	2128	msedge.exe	96
PID 2128 wrote to memory of 1088	2128	msedge.exe	97
PID 2128 wrote to memory of 1088	2128	msedge.exe	97
PID 2128 wrote to memory of 1088	2128	msedge.exe	97
PID 2128 wrote to memory of 952	2128	msedge.exe	98
PID 2128 wrote to memory of 556	2128	msedge.exe	99
PID 2128 wrote to memory of 952	2128	msedge.exe	98
PID 2128 wrote to memory of 952	2128	msedge.exe	98
PID 2128 wrote to memory of 556	2128	msedge.exe	99
PID 2128 wrote to memory of 556	2128	msedge.exe	99
PID 2128 wrote to memory of 4340	2128	msedge.exe	101
PID 2128 wrote to memory of 4340	2128	msedge.exe	101
PID 2128 wrote to memory of 3844	2128	msedge.exe	102
PID 2128 wrote to memory of 3844	2128	msedge.exe	102
PID 2128 wrote to memory of 3764	2128	msedge.exe	103
PID 2128 wrote to memory of 1236	2128	msedge.exe	104
PID 2128 wrote to memory of 3764	2128	msedge.exe	103
PID 2128 wrote to memory of 1236	2128	msedge.exe	104
PID 2128 wrote to memory of 1236	2128	msedge.exe	104
PID 2128 wrote to memory of 3536	2128	msedge.exe	106
PID 2128 wrote to memory of 4868	2128	msedge.exe	108
PID 2128 wrote to memory of 728	2128	msedge.exe	115
PID 2128 wrote to memory of 728	2128	msedge.exe	115
PID 2128 wrote to memory of 728	2128	msedge.exe	115
PID 2128 wrote to memory of 1552	2128	msedge.exe	120
PID 2128 wrote to memory of 836	2128	msedge.exe	121
PID 2128 wrote to memory of 1860	2128	msedge.exe	122
PID 2128 wrote to memory of 5232	2128	msedge.exe	127
PID 2128 wrote to memory of 5232	2128	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.resight-cheats.net/resight-v3.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff744ac188,0x7fff744ac194,0x7fff744ac1a0
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,6517663166941066126,8928986886746075739,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8616069935056216290,1481736100155642056,262144 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,5319448083456665863,11335698231185655369,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,16604678761957135689,18286037368268624262,2097152 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8330487808431708285,7927038006941843064,2097152 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,12950395415594122170,13470225591062652552,2097152 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,10411531286669643807,8777728280892899701,2097152 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,13965330358667421485,10409244313988799781,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,5562381072839269838,5559090492591725396,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,5817383020225845351,16273589817614343424,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,10472940125374467496,8169371635086029629,2097152 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,18339266257417014414,1484726846992187154,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,8407660798348123535,16010577041021765515,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,8407660798348123535,16010577041021765515,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4196,i,838854959310512108,13505455885355990885,2097152 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,10816381925605603812,16012548466016045372,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,10518731052179343767,15245670721683107456,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,9043403207247144662,4164196333913715539,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8285781273183300585,13602502280814177938,524288 --field-trial-handle=2448,i,12556120808667380559,4708892419733330295,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4344

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\resight-v3\" -ad -an -ai#7zMap4726:82:7zEvent31366
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2192

C:\Users\Admin\Downloads\resight-v3\resight-v3.exe
"C:\Users\Admin\Downloads\resight-v3\resight-v3.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3047088b-090f-48c6-b9b3-14ad24c89b12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3047088b-090f-48c6-b9b3-14ad24c89b12.tmp
Size 8KB
SHA256 e1915a0ee9552e03f8d17966024d2cb5d21108894c11a90bc19d3d05da6a024c
MD5 1dd36f144da1ab9c3d186a9e2689df73
SHA1 c1735710109fe9a8f5d7377b41dffeee526b899c
SHA512 362737515e0f189ae2e8ef060753f358a76b975f09d4e3867c83a36ad472d049edc4ca01ee576dff7e4b90bab1e858a34703125420b93ca44a16b2a28fa0a5fc
SSDEEP 192:aONZ6IE7QmiUy4VTPuIGmhQRx4LC7sY5U6:aONZ6DtDPuIGmh/UsUU6
TLSH
T15802F835ECB8BC7B9EB3AE09F4877A236EA5113BE6852F84D6D45E1D00D724C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

505cd458-0db6-41e1-9679-5c1a52b4f7e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\505cd458-0db6-41e1-9679-5c1a52b4f7e0.tmp
Size 8KB
SHA256 2a75e742ce71926347c1393cd5f98d1a29c8ab4a65b3d4b4ed3a76e1024158f3
MD5 7a9e75191baa69cf03a6276894dd67b5
SHA1 f20f88e54d239d3d4dae07dd8036f644f0c9cd04
SHA512 d18ab21856e5544e46c66f2dedfc8d67800fddf987d59958a0a2075eefd764cd096e24eddaedf27f054f2fd311c85e186f4424301f954daeab338611ae5c13e2
SSDEEP 192:aONo6IEEQmiUyOVTIuIGmhQRx4qPNeU727HDqrU6:aONo6DUPIuIGmh/qPqHoU6
TLSH
T153120932A8B8BC7B9EE3A944F48739139DA54227D7C97F90D6DC2A1C01EF25C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6458dbc7-07b7-44c6-8e2c-c9febd47e881.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6458dbc7-07b7-44c6-8e2c-c9febd47e881.tmp
Size 18KB
SHA256 0c27cce6e0cf73b813f4aae8678ef5af546ce393a0944322a50d0c6b7baf8fe3
MD5 a1c9c3cc44412587f44e164de2020a8d
SHA1 cbe16de7c78ebddb359d9862d9e6cb92d19a9d47
SHA512 e505d09b261289a475fe2a79869c0d7b282741a2e6b27eb38b2fb6f787c96908ebb643d2f4cc29e2e634e9e0f3aafcdcc4f227216bff66b6612671d389431e5f
SSDEEP 384:qZcIXsNNZ4Nu1764zIGmh/qP6iotgOIwZOyYL0oU:IX9Nu4KeCiioXsjQn
TLSH
T158828E329CB8AC7A5DFB9504F48736035EB88177D7C9AF90D5EC9B1D01EB298030B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7f52890-373f-4b72-8ef7-7b5e28ee7b8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e7f52890-373f-4b72-8ef7-7b5e28ee7b8b.tmp
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e73b391410b47c494ee7953905a0c60fd04c6bc35617583539b46b92968689a8
MD5 c67fbef7f62bf0056c3e3f786716b78a
SHA1 45f832458a5b84f29df5280a7973ebf46d014c4b
SHA512 623599849df6e275e849b53aa15de4c0c6df018ceb72805f4afbfea2a8577410fc6f21085b8473298805a9eec11bfc75b61276472cfcad39c54461995984dd1a
TLSH
T180D0C0F0CEF896F0F031343C01344142308C274122021211B432001C0C900C34265DE8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

10909f4c-eefc-4d7a-b418-c35182d89bd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10909f4c-eefc-4d7a-b418-c35182d89bd7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2f20df72-8236-4253-a7e4-b951cf95cd61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f20df72-8236-4253-a7e4-b951cf95cd61.tmp
Size 9KB
SHA256 489bbbeb3ade77000217c771523fa5c4d79a9fe184f04ec6c89238cb5e0566fe
MD5 014f0aab5809ec84f06d5d550fd226f0
SHA1 cff90a4aae51616ef58ce855c92d8b5a84d11109
SHA512 67630bda366f98a53f395919873c9e59499bb9119200ae1fa7065b774cf3e1d10b187a2978c0ce677f4461885ae863e62be73291c22b9b6fb07ae22b27599e12
SSDEEP 192:sxZoRHn5/f+sEVT5IdpJHW6+WNGYapcnHIg5ZJ:sxZol5/f+sEVOJHbGUF
TLSH
T11422B8126E38A57B8CCBD21DBB657F53D6F9503261D51E88EAFC862C05E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

476a78b9-3340-4ed9-9ea2-e80221e106c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\476a78b9-3340-4ed9-9ea2-e80221e106c4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a40e256-0f57-408b-9404-07c36d83bf4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a40e256-0f57-408b-9404-07c36d83bf4c.tmp
Size 27KB
SHA256 5576addb1ee72790657253ac8846645c22f4b5d0dd5a1cf5713a501bd0ec840a
MD5 ef2414569ce65a560c5bd17911eda6b9
SHA1 6ad02420f11dc3b67e8b9d0c37bec389e50e8109
SHA512 8e4e8f85d9feb53785a9a1b6ba1d9c10552b60cdce80f7cddf87c50d907bc53f8119a400c915aacbd378c42f28fff7ba4b42b14223105ed2a5843f38b1a78f4e
SSDEEP 768:9rWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7ero4UfeYmRb:9rWPcLKWvKeEeu1jaClLiF714UWYmRb
TLSH
T16FC2EB3B640CCB7E4FC01A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0385669b3cdb5198db61ab179b9f3808000c67143560ce050732773dc6c45cfa
MD5 84d389a1e22ccc92e8abe320a6444c87
SHA1 2dd3f94e0d5cad1b62336e587e2be3d852476897
SHA512 51533a6ae21bd4d496cd0c60a3fa0ba3c0efb52808b319e0b1e7feaf61bea92c1065e5c859178d98d0cb90881598095a7d55fd328d92c9806fd26f64b8b0c607
TLSH
T1CEE07DE415C9C62EB308749B12A8570DCBE1365FD7D0694E1B40C585740A440FAC2BB8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 22667ef2b7c0762a377862cfa5fc29839ad6ff8f24402eaad96139fb75867d08
MD5 6180e39ee2ebd780f075c71b0264f3a9
SHA1 6de5ece4ddb7717359b76925239e110a9a71dcc3
SHA512 436bb193e76be9e1bea55fe62529e91b3843ea46bdc0ae2d8d86bdb328f93fcd2e2cb3a0f3cb1b20808b1fed413adcfc83bbe9ad4de90f79681a2b5b80c4ee90
TLSH
T15E51EC499698A865F7A81C7942F5A38B373869C1CDC72E371C9CF93C7F8A3825102240
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6b717212213b6c933fbc283dfa61e5b92f2fe4b85c8c3f48ba6b1ee504169ec0
MD5 138111defa357e1df8b16934a4fc3a5c
SHA1 82b822212202662243ca544119145edc3c9b8994
SHA512 dee9578d37bc1b5531857d6f16c24d466a46cb6d5474b2cfed8833a3b1805232b74eb86dbfe784a6420dd58c19e1dce57f2f8db7656123f35e09179ae343e340
TLSH
T16851CC499A98A865F7A81C7942F5A38B373869C1DDC72E371CDCF93D7F8A3865106240
MD5 SHA1 SHA512 TLSH

Submit Download

f60646a7-f0d5-493d-93bf-45b3b06c120f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f60646a7-f0d5-493d-93bf-45b3b06c120f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

451d2c4b-42fb-4160-801b-a4bb59ab6794.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\451d2c4b-42fb-4160-801b-a4bb59ab6794.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d459662d-41d7-4482-85b1-b6fe325e9f20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d459662d-41d7-4482-85b1-b6fe325e9f20.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 035083fd56c8e446af053fae6ed1c5aec610948e0e38210da8128f625e1442da
MD5 7c4872b0c37067352e03474595c60ab3
SHA1 086b85f0ca918284733fe2ec37c4299bc69e2b49
SHA512 6607c87c0c702471f46ae1274b05d58f090becf4c18d87e725274fedb2be7b34fd1409f78260d69d6b3c091f0041c67b24b5cc5004bec9055e112d3f4328909a
SSDEEP 96:KsUgKda8S+FWKGQKObyKowDIDCGISiJ12tEj+JKrAj4JXQ4lOC6g:6zS1xlUIDCGISiP2tS+8Aj41Q4lOC6g
TLSH
T1CFB10F11367A224038BD2A0C95B4872B72423173351AF62F7BFD61A65E6BF044DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae6c47cd-893f-47a7-a5d7-3c395ec9b056.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae6c47cd-893f-47a7-a5d7-3c395ec9b056.tmp
Size 9KB
SHA256 c656e3a3406f7be66f5515bfb5cd7b0a4185e8eda40fc04555313c276154833d
MD5 31722a0ecff4f6d10a1b386421e31514
SHA1 daeb3e58d38ff323e46faa5236e2b3027fbc0872
SHA512 c5a0b147c4266616bc60aecfa3849687a82478c08a72de1062e78ff2a8a0182538d85a388ff9cd611019e4da27d3a3758b452505c779f466c0f1b32ab9510d49
SSDEEP 192:sxZoRHn5/f+shVT5EdpJHW6+WNGYapUQHIgrJ:sxZol5/f+shVGJHbGp9
TLSH
T10A12C6126E38A57B8CCBE21DBB657F13D6F9503261D51E98EAFC862C05E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff10bf03-27b3-409a-9154-a7ed492c9001.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff10bf03-27b3-409a-9154-a7ed492c9001.tmp
Size 10KB
SHA256 f24ad71c158eea29713bc1eaf73d504330b4aefaf3d658c7f444692d04a52812
MD5 53599d3ddd0e75c15c681719bad75274
SHA1 e13801dfa1c3cc63a3516d5d09f04ae0cc94bd85
SHA512 7452cbc2dff807af83bb0f77f2e2f18a3ae66d734d439eafbd6b4d29483ba2cd7b421d62213643e0a0a0758ca1c39f057c3a67933be35c5dc6a0ec28d2223e76
SSDEEP 192:sxZoRHn5/f+sEbT5IdpJHW6+WNGYapMnHIg5DJ:sxZol5/f+sEbOJHbG4r
TLSH
T1E422A7526E38A57B8CCBE20DBB657F53E6F9503251D51E48AAFC862C05E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccdf8134-be7d-41ce-82f3-907a68f7a6be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccdf8134-be7d-41ce-82f3-907a68f7a6be.tmp
Size 18KB
SHA256 ea47a57b63b631d91457d28a3f1188dcd531737724e8abcb77efe9d1e9bfa823
MD5 fae474f55ee6d0b97b821101f7fbfbda
SHA1 a7a174b77515cc0ef0da71fcddd335fcdc32034c
SHA512 312bdfbaf6fb66ae58754e2425e74606cda8649e990b16927e7287bbe01bc4ab64b6c370542e13f0341f4cc8ee422226e9e1aa3810574f044b12547a5e60ac1d
SSDEEP 384:jZcIXsNNg4Nu1764zIGmh/qP6iotgOIwZOyYL0oU:7XINu4KeCiioXsjQn
TLSH
T1E3827D329CB8AC7A5DFB9504F4863A035EB89177D7C9AF90D5EC9B1D01EB29C030B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfcdc303-963f-48f5-a5c0-683036edeb39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dfcdc303-963f-48f5-a5c0-683036edeb39.tmp
Size 12KB
SHA256 f54d6ccd106d16d406af2d3830ecc0c9251dd9ef9d291cf660f6695ea9b98ddd
MD5 a2867052c13b358fc4de5a39ab70b3e2
SHA1 59793f77e89d803366a146b431d0f474d346a108
SHA512 7f44874ca8b88ee4b5999d01edf4456f79c986d0987198d014047d2dbf62c7c182e57afae8bd2089b7528da1548ef0f28a004cb906e86923adda7d87dc5608bf
SSDEEP 192:dLsNN5QbfcOIoE1nTQmiU1jUn4zIGmhQRx4qPNeUI97iDqrV+lNObO:BsNN54Nu1FC4zIGmh/qP6ioQlEbO
TLSH
T1AB424B72A878BC7B9EA7A904F4473A136EB44177DAC92F90D5DC6B1C01EF29C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe5e63c1-fd53-45df-a215-8d39eee6b82b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe5e63c1-fd53-45df-a215-8d39eee6b82b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9d87e0e3ea968d81bf9a6b2dd33d1316b5a74dbc36a613ecd42354ca57c273ad
MD5 209badd728e3a7ec9ea8f644aef78820
SHA1 d84ceaa0fba07f38c29e8ab24313e7136d18eab6
SHA512 c63eb0ea18c77d04341e46c136aa1e29143f6fdedde646376c72bb5bdcf8f2255ab4a42bac132d0bd2b3b0537faa7a398eecb78f162ab818030bbbb40afbe20e
TLSH
T111413D58B6EA1044B3B76E566FF2A86D887F79372F07D4AD00010E4E4676B40C8B1B77
MD5 SHA1 SHA512 TLSH

Submit Download

9bc2730c-010b-4559-9d22-a335db9aeb48.tmp

Path C:\Users\Admin\Downloads\9bc2730c-010b-4559-9d22-a335db9aeb48.tmp
Size 50KB
SHA256 0b83d923ce5893624b404a8792307948bd23362c380e52803970f8bb1abb6c30
MD5 b31ecd5a98bda00545443123deb96f8a
SHA1 e69f26630c18b700535279536941251c7dbb5099
SHA512 1fffa8ba956e42f319f8f9021977bee94c9e99761475e2170c5a265160a54e446e2bcc8a45566cf24fed3659a837e44489068fd926ef5578db5af2faf2a0d5cf
SSDEEP 768:ugwLZ4uGBwMsXRXBiNINggGsn5xf1OJgc/up/UQp3eAl+yd0/elJClUXSq4p:up6B4XRXBQ46sLNigcGMAlju/e7+Ui3
TLSH
T1A433F171E204CEDBA33365B59F95AC4096134DEF33F285AB94CA5D2292803A4F0739B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\Downloads\resight-v3\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config

Path C:\Users\Admin\Downloads\resight-v3\config
Size 3KB
SHA256 60099cf91bb1a5717fc1f2d23cf36a61d3bfb70d9489fbb6f4bae98c560bf3d5
MD5 d9bc824737177af5792846f26507231c
SHA1 c44835e4881d95a97b597bebff5deba0233a5887
SHA512 f9558f9e985643d8205b5534998412a5896bb6f5712bce5d6cf27469200eed64f29efc01936ab00c4a93625b0fc573036fba00ba2c4eb1d1d7c47555608f11e8
TLSH
T114610CABF16C48F87171266692FFFBEC51B380A0DD3D2105AE11DA021927F67C853AC6
MD5 SHA1 SHA512 TLSH

Submit Download

resight-v3.exe

Path C:\Users\Admin\Downloads\resight-v3\resight-v3.exe
Size 12.3MB
SHA256 de441851831a4b39000ace28121e16a6ec6d6eede554638c373808118338fa41
MD5 81007d33db73f2a945f26848e0ff9df5
SHA1 366c3d0bf4e3e790b4f6b2fc6c08a6749f207751
SHA512 a2adcd363437620a59b72002ad244f343c13650a00b5dd50481e8ab2be6a3907992e406be1814fbf26b560cd8c7be9ad370f7e9789e03c685d85491694a70520
SSDEEP 196608:bFkQgkFlZ1NtqsO/DUbAui/JBTMvupSsahf9qWMlwfgVGzHIl8UJiheAjvWy:RjTTXNtqsAu4BTjuhlUA3ey
TLSH
T14CD623E955D262B4D4D30A40754B43AA75C0624D85FD4C2E3AC73E412B2ACFF624EEBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-552-0x00007FFF835B0000-0x00007FFF835B2000-memory.dmp

Download

memory/2356-553-0x0000000140000000-0x00000001413F8000-memory.dmp

Download

memory/2356-588-0x0000000140000000-0x00000001413F8000-memory.dmp

Download