rhadamanthys | hxxps://dinoverse[.]life/

Analysis

max time kernel
506s
max time network
506s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
19/05/2024, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dinoverse.life/
Sample240519-qb52caab4t

Score

10^/10

rhadamanthys execution stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2912 created 2524	2912	update1404.exe	41
PID 3132 created 2524	3132	update1404.exe	41

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4536	powershell.exe
1352	powershell.exe
2504	powershell.exe
2908	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
1052	Installer.exe
1092	connection1404.exe
2912	update1404.exe
2896	connection1404.exe
3132	update1404.exe

Loads dropped DLL 3 IoCs

pid	Process
1052	Installer.exe
1052	Installer.exe
1052	Installer.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ipinfo.io
29	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 2488	1092	connection1404.exe	113
PID 2896 set thread context of 3236	2896	connection1404.exe	124

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\launcher289\connection1404.exe	Installer.exe
File opened for modification	C:\Program Files\launcher289\connection1404.exe	Installer.exe
File created	C:\Program Files\launcher289\update1404.zip	Installer.exe
File created	C:\Program Files\launcher289\update1404.exe	Installer.exe
File opened for modification	C:\Program Files\launcher289\update1404.exe	Installer.exe
File created	C:\Program Files\launcher289\connection1404.zip	Installer.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1404	2912	WerFault.exe	112
1736	3132	WerFault.exe	123

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 863102.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Installer.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
2928	msedge.exe
2928	msedge.exe
576	identity_helper.exe
576	identity_helper.exe
1448	msedge.exe
1448	msedge.exe
5096	msedge.exe
5096	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
4536	powershell.exe
4536	powershell.exe
1352	powershell.exe
1352	powershell.exe
2912	update1404.exe
2912	update1404.exe
3548	dialer.exe
3548	dialer.exe
3548	dialer.exe
3548	dialer.exe
2504	powershell.exe
2504	powershell.exe
2908	powershell.exe
2908	powershell.exe
3132	update1404.exe
3132	update1404.exe
1216	dialer.exe
1216	dialer.exe
1216	dialer.exe
1216	dialer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	Installer.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1052	Installer.exe
1092	connection1404.exe
2912	update1404.exe
2488	BitLockerToGo.exe
2896	connection1404.exe
3132	update1404.exe
3236	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4628	2928	msedge.exe	79
PID 2928 wrote to memory of 4628	2928	msedge.exe	79
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 484	2928	msedge.exe	80
PID 2928 wrote to memory of 3336	2928	msedge.exe	81
PID 2928 wrote to memory of 3336	2928	msedge.exe	81
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82
PID 2928 wrote to memory of 4360	2928	msedge.exe	82

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2524
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dinoverse.life/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbef623cb8,0x7ffbef623cc8,0x7ffbef623cd8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Users\Admin\Downloads\Installer.exe
  "C:\Users\Admin\Downloads\Installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/launcher289'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Program Files\launcher289\connection1404.exe
    "C:\Program Files\launcher289\connection1404.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/launcher289'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- - C:\Program Files\launcher289\update1404.exe
    "C:\Program Files\launcher289\update1404.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 576
      4⤵
      Program crash
      PID:1404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/launcher289'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Program Files\launcher289\connection1404.exe
    "C:\Program Files\launcher289\connection1404.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/launcher289'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- - C:\Program Files\launcher289\update1404.exe
    "C:\Program Files\launcher289\update1404.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 584
      4⤵
      Program crash
      PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,7425306343377153062,12358327670344773588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004DC
1⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2912 -ip 2912
1⤵
PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3132 -ip 3132
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update1404.exe

Path C:\Program Files\launcher289\update1404.exe
Size 537KB
SHA256 5d130be35a463bdb29cb5fac2192c45752b8efc70c092c809632c7a222f67985
MD5 00cb831779c6a4ee61067448973386e1
SHA1 ca34052604fe6e8bea898a5e7b6e449f5b5a9581
SHA512 6b53ecfe617dc0768c16dd470f8701d755652e9caa32afc539cb0cbf5d025d77239ba751982e4a2a5184de777ffb06135abd6656ee9d8880d6e1e8681133274f
SSDEEP 12288:RBHAghJtMmhHt8Sir9yf7vEwkIqy5EAldg/8oQn:R5CgN8Sicf7vjbLldg/8oQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a
MD5 1e4ed4a50489e7fc6c3ce17686a7cd94
SHA1 eac4e98e46efc880605a23a632e68e2c778613e7
SHA512 5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae
MD5 8ff8bdd04a2da5ef5d4b6a687da23156
SHA1 247873c114f3cc780c3adb0f844fc0bb2b440b6d
SHA512 5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 1024KB
SHA256 6d28213e8a13795fe5a802e4dd6594e9b54121f0d981623eca50b2d07ef72cb5
MD5 7f032c5b9c8d057e4b1fe8540a37c769
SHA1 a2a46f9c7065a6004229af3d756d8cb9abf97754
SHA512 84c277ca93b6ae858b7007ee922702597b89d036758a81fa1fb3cd14c74ad4f1a08a0449f967009494036366ca621a6cd4395adb94b331e1c52e4850803fd04a
SSDEEP 24576:k6zOc6cL3UuP0Vk6HvtdWWtyP8sykEmX7lIPk7uk0dURx:N6KkXpHXWbFEmX7ok7lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 1024KB
SHA256 344caa05ece1fa69260663ab35335de5247cbcf2531e381ab1f030cce49ea7ae
MD5 4042124028b91d1a99282474afee6695
SHA1 35d0ff5a109f097bb6d988279183bc07fb2dc34c
SHA512 513480f081231bef099538860ff85547d79648230738413fafcf6a5379b16418f576ac701a107ee6975f8ef762c45ee4f1cf9fa3ea927c0ec660c38cbb3fd790
SSDEEP 24576:8qxI2QeuGE3sKmWwi0ekxoSuEoHRsoTjXYUVA:8e9Qk6Ai0doREmRtjbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 1024KB
SHA256 8d0cece7543da9f450974681ccfcee5ae10bdac1114a7b6146d00b63dc06fabf
MD5 225b70a7e2c4cefe3d02d300d929d1a9
SHA1 1a4783b52cfa7c1e64dc40bb8a8cc0706eb12ae3
SHA512 25d0e58d6d4565bef918083efd44cb77aa6b1d762fda10a4a1d45a6d62130af9ef3636b6700193ad22f4cdcfd9e91f331f87f00844fce4922cf1ffbf07c398ee
SSDEEP 24576:fL3fl48XtNU/brds8AxUUlfxGAR0HOswE0drv1AndnR9mB:rlRCbrds8Ax1vGMbsw7BvanR9mB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 510KB
SHA256 a456979d0bc7f612475eb68ded29b594ceba41650c32d5f71b3cc4e1e896c177
MD5 b879d940ea34e6bea3bc55ff2176747c
SHA1 85f506ad35f6ed4aa053abfb8d2fde3cfc6727c6
SHA512 30f070cf1d700590b7a0d81765833537fb402fb150ef46346c8b15d6b849ed01f88422e826f865f9ff40fa1f7048836f61a3c000d138896c85424fa9f95b2aae
SSDEEP 12288:YnDkBkVvJxiuBxy+3SgRciMDKfZN5W7Kwo6cIse7uS+bVZxEl:YnDrhxiuDbcfDQZNl6cI3bSxEl
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Size 1024KB
SHA256 3523058d6554325b6e6acf60ea91065509a881998e8de6ffab6cea3a750b5c5a
MD5 0a450259cc7622169bcba45108b7ff83
SHA1 b8d13804710d47ce8113cb97c82a798e60b5682f
SHA512 65f8d60b891ca2d9b78e8d755d857b7ff32d435a995cde85a98b2586e6f4ef71eb8bd9a14cae694a836943d10e3c8824a8d0f9fa4ec23b29de8b8c1bc23538bf
SSDEEP 12288:c5goyJchz+La7H42D+1El3+6Ir50CgRuJBVAKufREdw0K5OqUDx/c8576/aDZocF:a2yhz+Lap+M3HIFxAWAK/KgB026W+z0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Size 188KB
SHA256 4824f64e90a96b2be7d8595db08ffa358d2b326e98418c75a32bb5449187f865
MD5 ef4ae4164c96867b2672fde3d35cf522
SHA1 08e1e081c25d194e0f594fa5dff148a5345af0cf
SHA512 d2e87a34fbb5ca0ad1eff99b5c72ee3bc8f51c9ed41829af413328b8d5b151dfba18925712abe8bfc3e88aedaa4b8398bba7ddc8ddb36ea562452a4da2216bd5
SSDEEP 384:ILllW42Sz7tFBG7HqRP1fw43WjSWHyS+/Vk2cmyenyooUWuwet170gY3EonWTrqi:eSABUu5mWrkfmm+iVEoWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2027db9d983f7610c4bb33532185ff8c5caecaa4f1e6ee0c8f44027a3427c69c
MD5 4ecf4435cc35bd94e3692aae13fe249a
SHA1 39dd9f332d26179c6a8156b02459bfd3dc802b15
SHA512 730a0fb3465fe420da61d73156669128d969c96ad25134486d91e7e26defaf9ae8ca5bb05f67a9eb35f9e5bb5f85f3fa0b8ee37d5d46117a74555686434bac63
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 472B
SHA256 741d285ed9ce3c347e2ecfe5827d34f21ab1526545724c1cd7dda9e5b4df87ec
MD5 06ec671a1ada1e78bf7a8d7c874ab2b9
SHA1 07021de9709df28b34fcd9db6d2b22cb2eb609bd
SHA512 94ecbecf29d82ebff4b138aacb57d1b1129a6561d5728485ef73ab3a6ffde96c492f97421ba17016d12158582a08a5c4da6ba1e0caa78bce2e5d5f596a5cc434
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 472B
SHA256 ff9ed6d38029532408d33f29374d2bb1cb2fb5f8f4cb18b4bd9ef15c9cffaf34
MD5 f78e4975eeff0864a17c304789e6ca14
SHA1 307d563eb0ee934f5177f2ac476991531068249c
SHA512 71feb5c44277fa33f4a3248fa864ae60ec6c8d3d4e3ccc9360d699f3cc7b34bd9746c5d7bc9266b62790a791d73cfe18c58db1df9af150aec4cc49fdc0456479
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 58f58d1629e2a24e2b4129af6e8bcd9b75016aae12aa547e8ca123a08e9443fb
MD5 0058c06042547c2b9bf0adde108e69af
SHA1 fb035e90b0ecbec6bc3a2bd3ccd3c905317a411f
SHA512 847b47ace94d238b88fff094270dc04a9ac82aa4c6feb4e11118f09ca07f26db8c974ae5ceeee2c51b646cb07747a2fcd2d80eddfa3e313d1a5cfc8bf4f7c383
SSDEEP 96:n1k3DRZkj3wSv0MoiVmdHIFJXx0WQyV+VuziX3wI3:n1k3FZkLv0MAI/XxLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ebfe6489f366d90e26062426e7221a4c5fbeff33e4935e54c5fc260faf47f674
MD5 e4b9b55effc874541d2d4a927bbec75d
SHA1 5fa3d61030c590def64221e6702fc1eee84ba258
SHA512 e9f07d4788d644096ba4fdf1906727d2ca3dad8bbab9adb9a9c5071741c645fc5df356613d4ee54ec35bf4d94e6a4d6b7ba1576e3147b1860f70ec83e6292f1b
SSDEEP 96:n1k3lRZk93wSv0MoiVmdSup1jI9JXx0WQyV+VpAiX3wI3:n1k3jZk1v0MPuphInXxLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c35fb96f216b0da66d1c413b68dc359aca9bc45c175d7c3753d0519d7408ed47
MD5 70b61676037a28ff009e0be74c256a3c
SHA1 dad74c54206538e77e64e86a9450bbd268ace2df
SHA512 f0a419726e64c603bd3339659a8a408b77edfc04cd1aecdc016e8b922fe2f57ba8bd52317a32ab57a27ce0c8001bf9e2af15a5e16052b6c2d707d7366dc9c1a1
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGhzb63z7e2RU6q/RCOM2TacH2:M9iIxuERzA83h09RZxASGY3zrHqcOM0G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 43c2c8c3280ce3f7d06c139edf36ed6dc4416362346bf30c279343ea579834b7
MD5 354fdb094cd0964e6d929dcdddbef925
SHA1 c2a4e601899d858586afa523424decba37a37c2f
SHA512 e70d862dce3a526ae7fd3934d6d4823537fc87cf4ca592c30116dc40714341ef90b3e51ee53d26ac2c20da36b81dcdfde45bb929265a0edb567977590dcf94c2
SSDEEP 384:T9iIxuERzA83h09RZxASGY3zV1HqFAI5Os0VGzPR5Km/:oIxuERzA83h09RZxbGGzPGZEs0UvKm/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5bd9a51532add629e78f91d979b855ad947d0c6db797fdf860ddd2bcc6ee1fc0
MD5 75081bf36e551adf1c1358fbc6c810a9
SHA1 47e27f314de50fc873b018703477d57fadedeb6c
SHA512 4577bfa173213a4bedd30761232fc8b2444fe747b0ac23b7c5ca963e056929c3de449ec811978bfd6c5817cdacf54d57754145cceb4e68ffb3cb68282e448782
SSDEEP 384:u9iIxuERzA83h09RZxASGY3zV1HqFAI5Os0VGzPR5Km/:9IxuERzA83h09RZxbGGzPGZEs0UvKm/
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0f162f27548a84db1638bcf46d03661b5bcb3032e765fafdb597cc107639ba39
MD5 34e3230cb2131270db1af79fb3d57752
SHA1 21434dd7cf3c4624226b89f404fd7982825f8ac6
SHA512 3756cb01e82dbda681b562eae74d0b8ef8b3787b126119a51a92c51a78204a7805b9bdd60c00c50a3be23b843e78bb153b656540767069f739ce421b9bc02335
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d
MD5 df808b11175970c23f00e611a7b6d2cc
SHA1 0243f099e483fcafb6838c0055982e65634b6db6
SHA512 c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Installer\JozwCvctLH_tyEwIT3wAyhiaFcpakK0=\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5 SHA1 SHA512 SSDEEP

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Installer\JozwCvctLH_tyEwIT3wAyhiaFcpakK0=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 e284235a4d6e5d905692351cdfe8bc42ed842df8e5a8eb42fde90d1c3e2e90fa
MD5 0c147149b444748dae0a04e2e3d3269a
SHA1 f7edbcd6d1d6b199b6c997d6b781a794d736d3ff
SHA512 ec057829c03623cabc5a42ddebec9b75107f987eaf9cb642f3f1aed4d4c64c544f60a1dc7bc4208e025bce38c72091e615ac2fd9f1bd27651d49addcb0ae8b36
SSDEEP 24576:TgqKM/uABRPKWdTCG9YQ9HnsWJP41rWVxFyG/YtiB5gda4HADUSjNrNmH7Sz5PMC:TMM/uAXKWdTCGgWJP4AVx8WYgB5g9HA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Installer\JozwCvctLH_tyEwIT3wAyhiaFcpakK0=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 9c3fdfb42c920bf26f0fbeaee9a63a3d23b1cb35245320af48c69af4e933a606
MD5 425573cd9eea68d2dc78bd7a0e207dbf
SHA1 156ba2df6d5f9ac9b72bb1f9ff967d808cc23062
SHA512 91c2c7279bd4cf9aac6fb69917899556296e0121eb5a41974b311d887a13bc353acb14413ba68f96480091f5991edb9fed998b27dda1608b3518d6501db33329
SSDEEP 24576:hu64Z8enWTOyUXX8nzRpPfgnAAfOiVPawTfcyfyDGl2QdiLdbR4SSMjjvl7Zvcbv:mtvyMX8n7PIn0UPTfc232Qwh94ON7ybv
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_4f2zlliz.jeb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4f2zlliz.jeb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Installer.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Installer.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/1092-356-0x00007FF712C80000-0x00007FF7168D1000-memory.dmp

Download

memory/1092-351-0x00007FF712C80000-0x00007FF7168D1000-memory.dmp

Download

memory/1216-424-0x00000000764E0000-0x0000000076732000-memory.dmp

Download

memory/1216-422-0x00007FFBFE200000-0x00007FFBFE409000-memory.dmp

Download

memory/1216-421-0x00000000024A0000-0x00000000028A0000-memory.dmp

Download

memory/2488-355-0x0000000000480000-0x00000000004D5000-memory.dmp

Download

memory/2488-353-0x0000000000480000-0x00000000004D5000-memory.dmp

Download

memory/2488-352-0x0000000000480000-0x00000000004D5000-memory.dmp

Download

memory/2896-408-0x00007FF79D190000-0x00007FF7A0DE1000-memory.dmp

Download

memory/2896-413-0x00007FF79D190000-0x00007FF7A0DE1000-memory.dmp

Download

memory/2912-361-0x00000000764E0000-0x0000000076732000-memory.dmp

Download

memory/2912-359-0x00007FFBFE200000-0x00007FFBFE409000-memory.dmp

Download

memory/2912-357-0x0000000003510000-0x0000000003910000-memory.dmp

Download

memory/2912-358-0x0000000003510000-0x0000000003910000-memory.dmp

Download

memory/3132-418-0x00000000764E0000-0x0000000076732000-memory.dmp

Download

memory/3132-415-0x00000000033B0000-0x00000000037B0000-memory.dmp

Download

memory/3132-416-0x00007FFBFE200000-0x00007FFBFE409000-memory.dmp

Download

memory/3236-412-0x0000000000960000-0x00000000009B5000-memory.dmp

Download

memory/3236-409-0x0000000000960000-0x00000000009B5000-memory.dmp

Download

memory/3236-410-0x0000000000960000-0x00000000009B5000-memory.dmp

Download

memory/3548-365-0x00007FFBFE200000-0x00007FFBFE409000-memory.dmp

Download

memory/3548-364-0x00000000022A0000-0x00000000026A0000-memory.dmp

Download

memory/3548-367-0x00000000764E0000-0x0000000076732000-memory.dmp

Download

memory/3548-362-0x0000000000450000-0x0000000000459000-memory.dmp

Download

memory/4536-293-0x00000238E0530000-0x00000238E0552000-memory.dmp

Download