xworm | 6c6055d7518c517f93721727ea96e5841db920f59091fe841a0be1fba5b3eff6

Analysis

user interaction
yes
max time kernel
82s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XWormClient_arx (1).bat
Size 56KB
Sample261110-ejdfhsyxc1
SHA256 6c6055d7518c517f93721727ea96e5841db920f59091fe841a0be1fba5b3eff6
MD5 d53c31222ea769583a9a059d518a2f7c
SHA1 1d2e586ecfa30d3d65ae0901d43e5cf1a9307d98
SHA512 a4d6ce6ed678d175668085e54ffc14d07197fd6abfd9ce22f04a798d9f5525218fcb915fcf3df7f0fa48c47747cf5097fa0a166511c8c35b0aea94bd09b78a48
SSDEEP 1536:DzNYqRlgFUnpl/jsOCFLmXy4FqhVFlzVQE9ZCDnRhz:fNlRlfji6irlzlZEx
TLSH
T13E435BD3BE4F3C448BD9D2431ADE5BD57A8E1786E4422C8DB70B9D1C825746A39CC28B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

danini.localto.net:6379

Mutex

RDLJRBdCthedpA24

Attributes

install_file
Windows-USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5016-26-0x00000000018F0000-0x00000000018FE000-memory.dmp	family_xworm

Executes dropped EXE 2 IoCs

pid	Process
5016	g4hjmkzuh.exe
1540	g4hjmkzuh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2036	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	g4hjmkzuh.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6092_11466006\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6092_937290153\_locales\fil\messages.json	msedge.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	g4hjmkzuh.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5844	cmd.exe
2396	cmd.exe
2580	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	g4hjmkzuh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	g4hjmkzuh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2580	cmd.exe
6032	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5768	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	g4hjmkzuh.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{7329CC16-8E24-4AB7-AD1A-D339F545382D}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6032	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2036	powershell.exe
2036	powershell.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
5016	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe
1540	g4hjmkzuh.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	5016	g4hjmkzuh.exe
Token: SeDebugPrivilege	5016	g4hjmkzuh.exe
Token: SeDebugPrivilege	1540	g4hjmkzuh.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 2396	5844	cmd.exe	91
PID 2396 wrote to memory of 5220	2396	cmd.exe	93
PID 2396 wrote to memory of 1696	2396	cmd.exe	94
PID 2396 wrote to memory of 2036	2396	cmd.exe	95
PID 2396 wrote to memory of 1660	2396	cmd.exe	96
PID 1660 wrote to memory of 6000	1660	csc.exe	97
PID 2396 wrote to memory of 5016	2396	cmd.exe	98
PID 5016 wrote to memory of 2580	5016	g4hjmkzuh.exe	99
PID 2580 wrote to memory of 6032	2580	cmd.exe	101
PID 5016 wrote to memory of 4848	5016	g4hjmkzuh.exe	104
PID 4848 wrote to memory of 708	4848	csc.exe	106
PID 5016 wrote to memory of 1540	5016	g4hjmkzuh.exe	107
PID 5016 wrote to memory of 6092	5016	g4hjmkzuh.exe	109
PID 6092 wrote to memory of 5472	6092	msedge.exe	110
PID 6092 wrote to memory of 5708	6092	msedge.exe	112
PID 6092 wrote to memory of 5768	6092	msedge.exe	113
PID 6092 wrote to memory of 5708	6092	msedge.exe	112
PID 6092 wrote to memory of 5708	6092	msedge.exe	112
PID 6092 wrote to memory of 3864	6092	msedge.exe	114
PID 6092 wrote to memory of 3864	6092	msedge.exe	114
PID 6092 wrote to memory of 1096	6092	msedge.exe	115
PID 6092 wrote to memory of 108	6092	msedge.exe	116
PID 6092 wrote to memory of 1096	6092	msedge.exe	115
PID 6092 wrote to memory of 1096	6092	msedge.exe	115
PID 6092 wrote to memory of 108	6092	msedge.exe	116
PID 6092 wrote to memory of 108	6092	msedge.exe	116
PID 6092 wrote to memory of 2520	6092	msedge.exe	117
PID 6092 wrote to memory of 2520	6092	msedge.exe	117
PID 6092 wrote to memory of 2520	6092	msedge.exe	117
PID 6092 wrote to memory of 5104	6092	msedge.exe	118
PID 6092 wrote to memory of 5104	6092	msedge.exe	118
PID 6092 wrote to memory of 5104	6092	msedge.exe	118
PID 6092 wrote to memory of 4932	6092	msedge.exe	119
PID 6092 wrote to memory of 4932	6092	msedge.exe	119
PID 6092 wrote to memory of 2388	6092	msedge.exe	120
PID 6092 wrote to memory of 2532	6092	msedge.exe	121
PID 6092 wrote to memory of 2388	6092	msedge.exe	120
PID 6092 wrote to memory of 2532	6092	msedge.exe	121
PID 6092 wrote to memory of 4956	6092	msedge.exe	123
PID 6092 wrote to memory of 3248	6092	msedge.exe	124
PID 6092 wrote to memory of 3248	6092	msedge.exe	124
PID 6092 wrote to memory of 4208	6092	msedge.exe	125
PID 6092 wrote to memory of 4208	6092	msedge.exe	125
PID 6092 wrote to memory of 2292	6092	msedge.exe	128
PID 6092 wrote to memory of 2292	6092	msedge.exe	128
PID 6092 wrote to memory of 1684	6092	msedge.exe	129
PID 6092 wrote to memory of 1684	6092	msedge.exe	129

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1696	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XWormClient_arx (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\XWormClient_arx (1).bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5220
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5"
    3⤵
    - Views/modifies file attributes
    PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "[IO.File]::WriteAllText('C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\l.cs',[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\s.b64'))))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:winexe /platform:x64 /optimize+ /warn:0 /out:"C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe" "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\l.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47DD.tmp" "c:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\CSC3DBBF6F28AC4E0F97461C99C141F599.TMP"
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe
    "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe"
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ping -n 2 127.0.0.1 >nul & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe" & rd /s /q "C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6032
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\g4hjmkzuh.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_de0d74d25e7b4088b1c20359a0895089.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BA5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEBC3E8734EF8433AB6B0DE70279FD232.TMP"
        5⤵
        
        PID:708
  - - C:\Users\Admin\AppData\Local\Temp\g4hjmkzuh.exe
      "C:\Users\Admin\AppData\Local\Temp\g4hjmkzuh.exe" 5016
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcee47c188,0x7ffcee47c194,0x7ffcee47c1a0
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,4105590079325024952,1678577171289310276,262144 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
        5⤵
        
        PID:5708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2160,i,2834307571763828481,16689267925613137683,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2468,i,15291151030332805488,7645725350572470222,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
        5⤵
        
        PID:3864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6481052706940376018,4593333617498998372,2097152 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        5⤵
        
        PID:1096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,2797319098204408298,5857220647351270444,2097152 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        5⤵
        
        PID:108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,7325168710076380960,17916351408184208651,2097152 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
        5⤵
        
        PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,13985718311906695564,11034077759925467664,2097152 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
        5⤵
        
        PID:5104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5236,i,5828266263322057488,2556682496922254152,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5388,i,6195231468370600519,8412076805457924549,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
        5⤵
        
        PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5384,i,15745179976482075164,1743773564270106200,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
        5⤵
        
        PID:2532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6004,i,13388326562337021076,15470635810208451499,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
        5⤵
        
        PID:2932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6004,i,13388326562337021076,15470635810208451499,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
        5⤵
        
        PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6288,i,16495930654374596903,11524796158697756998,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
        5⤵
        
        PID:3248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6440,i,5316608697143594377,436303890767440345,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
        5⤵
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6232,i,12141537055634555299,11992553558100365996,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
        5⤵
        
        PID:2292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6408,i,16605902773424892358,2357917045793834014,524288 --field-trial-handle=2536,i,9872775189747692956,17815795777974263084,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
        5⤵
        
        PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

15dd03d9-bb78-4461-9dda-c20c5b28719c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15dd03d9-bb78-4461-9dda-c20c5b28719c.tmp
Size 37KB
SHA256 9b34cc6f6609c573e7096d9e87ebde9846e022e0952324578b9cbfdabdb469b1
MD5 fe6daa5ad4e14d99f291ddc5788a17d6
SHA1 5077676aa88f30a9acbd68b94666d62580e01a41
SHA512 95230c8883ed51e3a478a4b4207b81afa3d8122bf72f7c9185ef70afe1023c4bd02553ebc7b588e02c0cc60ba0abb77bad33d0f3882632ba683f5f373139bd44
SSDEEP 768:A/UxvxjgC+I3PrKBCE57Y0GZxJsXBdK8llNSHUPpMs:tZj3+I3Y70/JsXf7DNSfs
TLSH
T1EF03C034E8A09D735DF79390370E7397EEF446B3C5C55AA88AED6B0D028B26D430391A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59650e37-3c8f-4487-9b0b-9f4fbd583301.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\59650e37-3c8f-4487-9b0b-9f4fbd583301.tmp
Size 38KB
SHA256 19663fc9f6bd0d453e21ad0532eec0d7af60528044c258cb46a89aa7c2d823d5
MD5 81f74783aad6b87f22fc84e7a449dbbf
SHA1 87fccacb66c304eb1a1241b5ef70859adb280396
SHA512 e46bda5757e0792df65936179061c82b7de63275c5639d165f53429b377c4503897bc6eb593e23bb625865704f770830ba795fe174ad0e30c0c464aa6531692f
SSDEEP 768:U/UxvxjgC+I3GXQKBlE57Y0GZxJsXBdK8EkSHUPpMs:BZj3+I3F70/JsXf7VSfs
TLSH
T1E403C034E8A59D235DFBE290360A73C7EEF415F3C5C14DA88AE99B0C018726D170791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68ec3bcf-06d1-4400-abb2-743c01e143d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68ec3bcf-06d1-4400-abb2-743c01e143d4.tmp
Size 34KB
SHA256 57b5291bfb3bb4147d7232c06272b36d09695508b1f783bbe4105ddb54de22c4
MD5 55e5134658643d7c497ea8a528993a36
SHA1 f19757e0375fae27e95ba4a8652a7d84c553869a
SHA512 3c0172dadb05b3ecdc0160e520a505e294e188cc0c342854026345a934b257025af2a250aadc5eb3c9705ef9ae29756245b3e14ecdf915d57d65b73975de4078
SSDEEP 768:Lg3bZomKBkE57Y0GZxJsXBdK8ZkoaTZclHiLU:Lg3S70/JsXf7W9UCQ
TLSH
T1DCF2AF30E8A1ED634EF7D290760A37C7FEB056B3C9C44E98D9DA9B1C018729E174791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

3fbf882c-9351-4177-801e-143ffc16431f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3fbf882c-9351-4177-801e-143ffc16431f.tmp
Size 11KB
SHA256 66bf9d3cd97104ba73866a07031669f6b9ed63071e70d9ef1dd90a54901aa8a1
MD5 66f42ea75e8592a2b3bc945992841b29
SHA1 fefe37432e518117fd4fc08bc698725f616f8a3c
SHA512 dc6f7ae8ef098b599e4ed0d76a6b7e889d536d7b98843477f5e978879399b819f5ead9bbdf8a09f0dcbab9ef964925b02e03ec9a4adee5353c89dfffeefeebb1
SSDEEP 192:sxRsRwb3/fxsv0ZR/OzoA8p4r/g6+WNIYU2RfwRFGlIgVrHJ:sxRso3/fxsvKR/zS/5IE9p
TLSH
T13932C855AE28A93B8CC7D21DBB59BF53D6F95032A0D15E48F6FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe4418c6-147a-4378-aec1-7ad75aaff3b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fe4418c6-147a-4378-aec1-7ad75aaff3b9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

29c1f843-7b63-4856-b6e0-cabc4e54e46a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\29c1f843-7b63-4856-b6e0-cabc4e54e46a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

372aa17e-ded1-440a-aaa5-74043636e411.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\372aa17e-ded1-440a-aaa5-74043636e411.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ca1235fd-ddce-4dde-ab56-a7288aa5c758.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca1235fd-ddce-4dde-ab56-a7288aa5c758.tmp
Size 29KB
SHA256 258c6025cfc53ff65ab758fe95c27242a2f3d3b2f379beecdee40bb65ac7757a
MD5 6d341e441d39ad09f2a765305af319b6
SHA1 f99a92c8e6731c30ee16951b80f9084c778e7fd4
SHA512 0a3ed50d5eb9269f04e32cd8cb9b1d514c2d1bcaf48fcc4b02e2eb8a12e2874533aa45d5ebc53c324ab87cdb257a95b882c1e41f504327928c6c4c6625893964
SSDEEP 768:6Jaj4a7pLuLjFKWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEqgomBvropiC:6Jaj4yEjFKWgm0fbbu1jaTqghB8h
TLSH
T1C5D2B97B640CCB7F4F900ADD9D197E9B6DA802CB9698C98047FE981C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3952d1f-b08e-4f38-8366-a96591e96508.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f3952d1f-b08e-4f38-8366-a96591e96508.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e965ddd5-5817-415b-a20b-738a7f9534c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e965ddd5-5817-415b-a20b-738a7f9534c8.tmp
Size 34KB
SHA256 3cd791f487404ef865aef8f6e6b9cf6cfad1c876d3fb79e6f588c8c9d13ed34b
MD5 8d00aefbfa7656e971d1f968b0540cc2
SHA1 ec6e4b002b74975acfeb4c8d6385675fd732817e
SHA512 7ecc4cd03e547282cd1b65c3c3be7d679fbda4831ec5f77af5b60dc0cb17952d16c80ea61f7a7a8f9d8a97274df2ce7e8da0a7a92880cebe31b2d0558d615235
SSDEEP 768:Eh3XLMmKBYE57Y0GZxJsXBdK8ZkoaTZclHiLU:Eh3a70/JsXf7W9UCQ
TLSH
T1CFF2AF30E8A19E634EF7D390760A37C7FEB056B3C9C44E98D9DA9B1C018729E174791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df49978d-bdfd-4b56-9b47-5d0795d9a8a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df49978d-bdfd-4b56-9b47-5d0795d9a8a4.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

f8e929aa-e020-4a90-921d-7d49d66cd732.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f8e929aa-e020-4a90-921d-7d49d66cd732.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

g4hjmkzuh.exe

Path C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\g4hjmkzuh.exe
Size 17KB
SHA256 e7026446cb8b306dc1dda7ae70d7282e16784614e0f4d4ae6e61442ff6871705
MD5 7b4e4c698fb6af5ea2e4dcde4135b78e
SHA1 c64ba7d7847afa836bc638d15785365e272409b5
SHA512 f6f6679e157e72e4078f4702e478f3dbe2d3bd33740af706d1a23ed896cb37f6ffc588b7eddcfce710fa01af5f79c440409e368a1f88e9a0e789924487495f7d
SSDEEP 192:EB5iyjqkTJo/kFL6+sRnlLNxRdl35OvWRW1BQfainT31COib+H9t05+dJyi:E/+2fFklLRL5OvnPQyinT31tiS9t0iy
TLSH
T1C3723A05A3CD9261E5AE8B7C14F313394774E3631A8B6F4B4CE425791FA2BF805092E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p.b64

Path C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\p.b64
Size 22KB
SHA256 00c2bbd7e75d77576d5ba3891d782951b1f203129370bef6a396e6ba37d136a1
MD5 c216ad82af2afbc0fd0fdad1d30cc776
SHA1 04784575ffe45bb00de49c0d99e2132df532199c
SHA512 ba40b7bea7c7b872e15b8fcd2d9008990b24ab2bdd98d7e1fa66ef8a0a5ae2575b9ca09d6931e0faffaeffa9f5b89dc4992f932f0241b1119a901d2cc584f73e
SSDEEP 384:r+oLMQ+3x1xZgJlfzZv5OAFZK1Es2CpBkqvrO4vQIOTQckFQdHbaWnHuBmrjLLO0:r+BN3d6P7Zx7FZkACkqv521NdHbFnHuQ
TLSH
T109A2D081DB99598B0ECC19B5EA9E7126C4FC668DE010EE0EFE994C2A9323489654077F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s.b64

Path C:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\s.b64
Size 29KB
SHA256 f18161ec2daba220e725d9e2d90a772da8bf613390b3fa7ec02badfcbb8fcab3
MD5 e40054a0d1fba324dc5eb4db793f442e
SHA1 a724c4b0b9a19b99c8d5b1d27f640afcb5f5729d
SHA512 18f51f4666f11b15d4f570c04fbf7ec02b604e779668350cbbaeecd68f315276edcdeed16f406ee2603bc76cd735b4d94ad49acaf62fb53c5e48c5cafc8646ec
SSDEEP 384:NgZntC812j/6UAwy4+ra4quFyqhVGs+x7lZkOc3des9kG/hsptVruFD4dMA1:Ng3Cc2+UAwy4AcqhVGVlZsSG/hszEDEx
TLSH
T16AD295E7AD0F3C84CBEAD14706CE9BD53A4E0785E953299D430BAD0C865742E3AD858B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18a39b8c-1711-4f44-bcb8-1077ffa3de32.tmp

Path C:\Users\Admin\AppData\Local\Temp\18a39b8c-1711-4f44-bcb8-1077ffa3de32.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RES2BA5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2BA5.tmp
Size 1KB
SHA256 65b31bc9ff6d8dfc1fc386efb5e9dff87eaba6d6a3ab38fd5775950cbfd88b33
MD5 ba07f568705d7d898664a1dbce609379
SHA1 d9dc4881070638614fb64a492d76266ee165fafb
SHA512 0720f94f651bdbef7202a70a5e0153f4b7caedef645f333182439d81c76454df2090581def26a9f1e3896af0b6671bb89de42e80809672a3ca176fa24b82da54
TLSH
T102411F4083DC8B1BE17243312DF78719A678BE66AEAE475DB588522E1E02740DDC3272
MD5 SHA1 SHA512 TLSH

Submit Download

RES47DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES47DD.tmp
Size 1KB
SHA256 cfa976d9fcbdfcda8b394f87f85385d1d3948c15e3bae60684db7d58a53c9fc1
MD5 b9595f022cc99040097fc6180b3e834c
SHA1 ad38cfc73ace8492bc3f98f2fcc02075e681b68f
SHA512 034a6cc6fe997a51a9ade0f95b011573d85bec8984b8a6823ed91bb397b26d8b2bad65f1791d0194f8930dc0bdb67ea9440ae1be819d92e5e06245250a639eef
TLSH
T13E41004083DC8B1BE17243312EF79715A678BE679E9A478DB588522E1F12740DDC3571
MD5 SHA1 SHA512 TLSH

Submit Download

g4hjmkzuh.exe

Path C:\Users\Admin\AppData\Local\Temp\g4hjmkzuh.exe
Size 5KB
SHA256 d289b86ff8eb7294edf6f3dc449a23d753885dd3431533e833d60802ad3b4a33
MD5 c16ad4b8d9d1536073f2a9becace0e3b
SHA1 ebe0b8a130bb05da51523d82eff0dc2aba632ce7
SHA512 44438974c576496afe6b7fe542c63c16a1dca394356fe1ae7118713f9ca99a3ec71d63b7665819fcb7f565cb6cb021dd658bb14fb67585fd31b16f9d04aa1081
SSDEEP 96:Gdew7V9K080dkIoPs18BynqgHlNxjEQ7uvXgzNt:Gv1HoyqgHj+Q7ui
TLSH
T126C1B687C7CC8766D0670371A8B313422774E8264BABA79F29E4137B6EA57A009532F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6092_364654362\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

7781c1fd-6b5d-4d40-ac75-ff67268add53.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6092_514996598\7781c1fd-6b5d-4d40-ac75-ff67268add53.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6092_514996598\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 639B
SHA256 5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be
MD5 d2dbbc3383add4cbd9ba8e1e35872552
SHA1 020abbc821b2fe22c4b2a89d413d382e48770b6f
SHA512 bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66
TLSH
T1CEF06DE6DB5149A4F533492AB5097719EF717653A0D43D0D360CD2971FF022A8D4BA8C
MD5 SHA1 SHA512 TLSH

Submit Download

CloseClear.mpa.ENC

Path C:\Users\Admin\Downloads\CloseClear.mpa.ENC
Size 496KB
SHA256 b10ec64d57fe7081964b08e39dfde2f6b3acb663ce3b5d88bc8dbd35a9cf1856
MD5 baebcbfcf22dab61b8bf169231f5b75e
SHA1 9e14f8b925c1a8fd90cbf4b56644c1460ce8e0d9
SHA512 48c4e280edfa4d7105dc2af060a2a35c7ca20348a0736de150f38a4c205c61ede179f14ca477ead9b1d2c79f68a23cc6472f716b811e6a0d5454cae71ab6892b
SSDEEP 12288:PPF1NhjCFIqhSoOzfP6PKJgVdM7vHXd52wj1YpjaI0i6P:PPF1NdCF8oOzXNAdM7l5WpjEP
TLSH
T19AB4236D8B59D582677E9AF15FEB1218FC2C6ECF6E5272F3538834391CCA11906009AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseConvert.mht.ENC

Path C:\Users\Admin\Downloads\CloseConvert.mht.ENC
Size 1.0MB
SHA256 7c483b1fe0e641a24e436456e63164c7761f1c39902f7f591afaa5914df079bb
MD5 ac7133a6d8a1c6e0ba6fe77c94f999d4
SHA1 149beaabd13171877d7a7dd7827db36d6b3be2d2
SHA512 e34a60ce546a77b85066f76bd71d9085f00fa4b6e9b3f7d8061475c36395e30c6690c2502dadade2559a6acf839af18f2c8837e2d9d2966bc745f3e4aa0f2af9
SSDEEP 24576:Gi/G3TEkH7Ez0fR0mzszyJA003lpgiuFjO/4fQ+73Wla4XnUtWQkZ:GFISxfuY8yJA00AiuZO/4fQOWH
TLSH
T1742533A07551589B77C8CF6817E9C64BA082F70BFE9349DABDC1CBD29049E8B348D11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseSave.vbs.ENC

Path C:\Users\Admin\Downloads\CloseSave.vbs.ENC
Size 909KB
SHA256 1df51e2d2cc91931496f12e7cd2cc4473f4f563f0701edaa2153ca3029d6b767
MD5 2b367de89d97ce01da69b672cfd696a0
SHA1 bc6e23d9c054669ed85fd9d526e40eceeb0cad38
SHA512 98457ccf97f7b68ffaa37d643256f456113cb5802d87cbb5b52a4a34136fa814e0bde4b4d7a02942d0eb87bb8751f305186863ce2b3bedefafbe7b1ed9e6d89d
SSDEEP 24576:RhnGI3Hw0xCdeFi6I4P4YyrT4tz3bXLsIBjWCNx2Azs/lWyvd:RlXFAde/II4B4t7bXLsIxtNQ/lWyvd
TLSH
T1D415330FDB271BC2A65F86B460A97DC908DEDAB13097ADF922128D81F418E75711D0EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTUSER.DAT{f72c0d7b-ae7b-11f1-a029-f6a453ebf8fd}.TM.blf.ENC

Path C:\Users\Admin\NTUSER.DAT{f72c0d7b-ae7b-11f1-a029-f6a453ebf8fd}.TM.blf.ENC
Size 16B
SHA256 322a8987336a20ac07cb01f3e2a9908b4ba1a2bd9e099b15f198ccb0f097f879
MD5 0e52767de5f529c32889dcd2ff24e7d8
SHA1 41357b77663e721abe6db907dc6048a776581b66
SHA512 c1b2755edba6fff9dbc23c0255db604070cdbc0170c35c7f19cdd0a6aec450901c2d671ac1a138a09731dfd33542ed1ae0d322d6ce73d436966b780490da6fef
MD5 SHA1 SHA512

Submit Download

CSC3DBBF6F28AC4E0F97461C99C141F599.TMP

Path \??\c:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\CSC3DBBF6F28AC4E0F97461C99C141F599.TMP
Size 1KB
SHA256 525846d98a5cef7afa3df28b5f8d4eb25336c1a5e169757bc2906b41cae03576
MD5 b0694ec1da90941073f1bbd318826474
SHA1 5f2e5c590bf07eb1d5c811f97876317180840be4
SHA512 98555b0499b2d59b5887167a3e3dd5177a9c5e3522da6d0fd60f1a9c2e9af7e6458f5d2e2a850e76bfed1d7789f3af5e3c5245e8a506af2d350b39f97aa803fb
TLSH
T1D721AF85A3E8421EF2B347707AF2C363916CBE678D7A43DC7488175F1F259508583AB1
MD5 SHA1 SHA512 TLSH

Submit Download

l.cs

Path \??\c:\Users\Admin\AppData\Local\Microsoft\t4kd0jm5\l.cs
Size 21KB
SHA256 ea50ef18588e1d09add5ef7a2ee919388104b90f85aec9f938a656b95a376315
MD5 cf963b77e1000e8eceec872e8c837c02
SHA1 1dae6c7ce74854d5a508f4af2d58ced92256567d
SHA512 c6232e60d96d2d02127f21d739acc4ac31aac244d956d83808a897ec7b0ed357bd6877aa04a89e13e1676924e222107f1e282bd8346637f83cfc4fb4e67652f5
SSDEEP 384:NwKnJCy3+MatWoQBUkCq6X+ATn+Dc/qnz6:aYXurgXCqRDc/qnz6
TLSH
T16AA292622153E12802A323392B9A5055F372E433D2FBDD1DBD8DC6607F8A6657374BE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guardian_src_de0d74d25e7b4088b1c20359a0895089.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_de0d74d25e7b4088b1c20359a0895089.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-42-0x0000000000930000-0x0000000000938000-memory.dmp

Download

memory/2036-2-0x00007FFCF2ECF000-0x00007FFCF2ED0000-memory.dmp

Download

memory/2036-6-0x0000027563070000-0x0000027563092000-memory.dmp

Download

memory/2036-5-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp

Download

memory/2036-7-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp

Download

memory/2036-11-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp

Download

memory/2036-12-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp

Download

memory/5016-26-0x00000000018F0000-0x00000000018FE000-memory.dmp

Download

memory/5016-30-0x0000000003B80000-0x0000000003B86000-memory.dmp

Download

memory/5016-23-0x0000000000E40000-0x0000000000E48000-memory.dmp

Download

memory/5016-24-0x00007FFD09D50000-0x00007FFD09D6D000-memory.dmp

Download

memory/5016-29-0x0000000003B00000-0x0000000003B32000-memory.dmp

Download

memory/5016-27-0x0000000003BB0000-0x0000000003BFE000-memory.dmp

Download

memory/5016-28-0x00000000022D0000-0x00000000022D6000-memory.dmp

Download