e715093c67ed80963dc829d90e0d347186f3d3ccb53f554dc806fe18d87bcbd6

Analysis

user interaction
yes
max time kernel
568s
max time network
425s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShockLauncher.exe
Size 71.6MB
Sample261022-vb93hsgs7k
SHA256 e715093c67ed80963dc829d90e0d347186f3d3ccb53f554dc806fe18d87bcbd6
MD5 e0b589c4f46561462ceb312488bf4cac
SHA1 7927a5259263d88701730565fdac03b16bb118b2
SHA512 2ae4b66f8b18d19a9518b96282babcdf8a2d2ed6d2ad1f21b646f51dd3f967b03a930d5dbfda8ab8958c0a8a14de0822934c4356965abbf3364a65898e2a577f
SSDEEP 1572864:+ahmnSKwPiaRt4JH7L01oWI3MONoJ2lhcUv/klzSFus:++m5wPD4p7LzbcoO8klWFv
TLSH
T11BF72356E2F900E8D9BBC0B8C6571517E7B23445173497EB66A48A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3736	ShockLauncher.exe
3736	ShockLauncher.exe
3736	ShockLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 64003100000000002b5d467b10004f55544c4f4f7e3100004c0009000400efbe2b5d467b2b5d467b2e000000302b0200000002000000000000000000000000000000265b08014f00750074006c006f006f006b002000460069006c0065007300000018000000	ShockLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ShockLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	ShockLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ShockLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 5e00310000000000565d638610004e4557464f4c7e310000460009000400efbe565d5d86565d63862e000000f043020000000700000000000000000000000000000042d9aa004e0065007700200066006f006c00640065007200000018000000	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	ShockLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "5"	ShockLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ShockLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3736	ShockLauncher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	ShockLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3236	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3736	ShockLauncher.exe
3236	NOTEPAD.EXE
3736	ShockLauncher.exe
4920	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\ShockLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\ShockLauncher.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1380

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\New Text Document.txt
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3236

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New folder\New Text Document.txt
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\ShockLauncher\v8Tb3f0dndkV\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\ShockLauncher\v8Tb3f0dndkV\PresentationNative_cor3.dll
Size 1.2MB
SHA256 75fc0d383ea009ea9453a4589fa8d88d149abcac371bb5eb983d6ece8f1243eb
MD5 a5e9f16c6a381a2241bef8eed1c20309
SHA1 574d1412c55cb2321d2d6545cbb439368623e2a5
SHA512 d9509720807f9298caa1af3abbb098348726700815559febd3417d929e57c7839f498391e92e2a02d8c984db9bf786d25170471fea71bc64c9329b29242244e7
SSDEEP 24576:Tl8W6eU6UPXhA+JYCqX4T3MJj7OQ1Niqdhvc7PgNfb4i7fokJMpw5i2k1/m6eg9k:TH6emPXrYCqX4T3Q1Niqzc74xb4izMp7
TLSH
T118453A22D2E642E4C47FC1B8C646972BFBB17409231C66DB47608B652F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\ShockLauncher\v8Tb3f0dndkV\wpfgfx_cor3.dll
Size 1.9MB
SHA256 4c5e43b075c361ca35f04b8b1ba5cd85b00b00671731e49db5c690c92d957113
MD5 f69b75aef8075152e512cae615e4192b
SHA1 c437679e2dc249e9e9a02d10df9b86955e6a7b01
SHA512 c3c4d71c1b367760fa0989d259e67ff0b6d3b04476a08399cc69cb718083ad05d3f0803a3f928da08d8aaa2f075a2386091e6f8320f8796c5d68ed9159adf571
SSDEEP 24576:hp3YLMLrT18UP2HTePBDpuZiV1/QcqylsQdS/etT4ZdSAcMGuOk8SIXlTn:Ym3iUP2HKBDpuSUypM2tWdSAc5uOq8F
TLSH
T1EF953A4676EC40EAD47AE23CDAD7461BF23278142761A7CF23A4479D6F27BD0097A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3736-94-0x0000026907E80000-0x0000026907F10000-memory.dmp

Download

memory/3736-117-0x0000026907F80000-0x0000026907FA0000-memory.dmp

Download

memory/3736-30-0x0000026905820000-0x0000026906050000-memory.dmp

Download

memory/3736-34-0x0000026903A90000-0x0000026903B10000-memory.dmp

Download

memory/3736-50-0x00000269045A0000-0x00000269045C0000-memory.dmp

Download

memory/3736-46-0x0000026904570000-0x0000026904590000-memory.dmp

Download

memory/3736-42-0x00000269039E0000-0x00000269039F0000-memory.dmp

Download

memory/3736-38-0x0000026902A30000-0x0000026902A50000-memory.dmp

Download

memory/3736-70-0x00000269046F0000-0x0000026904710000-memory.dmp

Download

memory/3736-66-0x0000026904740000-0x0000026904770000-memory.dmp

Download

memory/3736-62-0x0000026904620000-0x0000026904640000-memory.dmp

Download

memory/3736-58-0x0000026904690000-0x00000269046D0000-memory.dmp

Download

memory/3736-54-0x00000269045E0000-0x0000026904600000-memory.dmp

Download

memory/3736-81-0x0000026907D10000-0x0000026907D60000-memory.dmp

Download

memory/3736-77-0x0000026907C00000-0x0000026907D10000-memory.dmp

Download

memory/3736-89-0x0000026907A60000-0x0000026907A90000-memory.dmp

Download

memory/3736-85-0x0000026908870000-0x0000026909010000-memory.dmp

Download

memory/3736-125-0x0000026909140000-0x0000026909180000-memory.dmp

Download

memory/3736-6-0x00000269013F0000-0x0000026902080000-memory.dmp

Download

memory/3736-121-0x00000269091E0000-0x0000026909240000-memory.dmp

Download

memory/3736-22-0x00000269029E0000-0x0000026902A30000-memory.dmp

Download

memory/3736-129-0x0000026900000000-0x0000026900010000-memory.dmp

Download

memory/3736-27-0x00000269001A0000-0x00000269001E0000-memory.dmp

Download

memory/3736-113-0x0000026908060000-0x00000269080B0000-memory.dmp

Download

memory/3736-109-0x0000026904790000-0x00000269047A0000-memory.dmp

Download

memory/3736-105-0x0000026907F40000-0x0000026907F60000-memory.dmp

Download

memory/3736-101-0x0000026909010000-0x00000269090D0000-memory.dmp

Download

memory/3736-97-0x0000026907DB0000-0x0000026907DE0000-memory.dmp

Download

memory/3736-137-0x0000026909820000-0x0000026909890000-memory.dmp

Download

memory/3736-145-0x0000026909D30000-0x0000026909F30000-memory.dmp

Download

memory/3736-149-0x0000026909A50000-0x0000026909AA0000-memory.dmp

Download

memory/3736-141-0x00000269099A0000-0x0000026909A50000-memory.dmp

Download

memory/3736-133-0x0000026909670000-0x0000026909820000-memory.dmp

Download

memory/3736-19-0x00000269005F0000-0x0000026900750000-memory.dmp

Download

memory/3736-14-0x00000269025B0000-0x00000269027E0000-memory.dmp

Download

memory/3736-158-0x0000026909AA0000-0x0000026909B10000-memory.dmp

Download

memory/3736-162-0x0000026909420000-0x0000026909430000-memory.dmp

Download

memory/3736-166-0x000002690F070000-0x000002690F080000-memory.dmp

Download

memory/3736-172-0x0000026911890000-0x0000026912580000-memory.dmp

Download

memory/3736-178-0x00000269129E0000-0x0000026912B60000-memory.dmp

Download

memory/3736-182-0x000002690F0B0000-0x000002690F0D0000-memory.dmp

Download

memory/3736-176-0x0000026912580000-0x0000026912860000-memory.dmp

Download

memory/3736-11-0x00000269048C0000-0x0000026905820000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads