nanocore | hxxp://pixeldrain[.]com/u/SyA8hZRH

Analysis

max time kernel
177s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pixeldrain.com/u/SyA8hZRH

Score

10^/10

nanocore discovery evasion execution keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid	Process
8	powershell.exe
3640	powershell.exe
396	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Launcher.exeapp.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	app.exe

Executes dropped EXE 3 IoCs

Processes:

Launcher.exeapp.exeApp2.exe

pid	Process
5044	Launcher.exe
1308	app.exe
2476	App2.exe

Loads dropped DLL 1 IoCs

Processes:

app.exe

pid	Process
1308	app.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exeApp2.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\app = "C:\\ProgramData\\Update.vbs"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Service = "C:\\Program Files (x86)\\LAN Service\\lansv.exe"	App2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

App2.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	App2.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

Processes:

cmd.execmd.exe

pid	Process
1960	cmd.exe
3076	cmd.exe

Drops file in System32 directory 2 IoCs

Processes:

app.exe

description	ioc	Process
File created	C:\Windows\System32\pyHrU4uR85.txt	app.exe
File opened for modification	C:\Windows\System32\pyHrU4uR85.txt	app.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exe

pid	Process
2888	tasklist.exe
740	tasklist.exe

Drops file in Program Files directory 2 IoCs

Processes:

App2.exe

description	ioc	Process
File created	C:\Program Files (x86)\LAN Service\lansv.exe	App2.exe
File opened for modification	C:\Program Files (x86)\LAN Service\lansv.exe	App2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

App2.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
3716	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133737724313927841"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

chrome.exechrome.exe7zFM.exeApp2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
544	chrome.exe
544	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4156	chrome.exe
4912	7zFM.exe
4912	7zFM.exe
2476	App2.exe
2476	App2.exe
2476	App2.exe
2476	App2.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
2476	App2.exe
2476	App2.exe
2476	App2.exe
2476	App2.exe
4220	powershell.exe
4220	powershell.exe
1612	powershell.exe
1612	powershell.exe
3640	powershell.exe
3640	powershell.exe
396	powershell.exe
396	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exeApp2.exe

pid	Process
4912	7zFM.exe
2476	App2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe
Token: SeShutdownPrivilege	544	chrome.exe
Token: SeCreatePagefilePrivilege	544	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	Process
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe
544	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 544 wrote to memory of 4360	544	chrome.exe	84
PID 544 wrote to memory of 4360	544	chrome.exe	84
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 3908	544	chrome.exe	85
PID 544 wrote to memory of 1712	544	chrome.exe	86
PID 544 wrote to memory of 1712	544	chrome.exe	86
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87
PID 544 wrote to memory of 1172	544	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pixeldrain.com/u/SyA8hZRH
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff95ab4cc40,0x7ff95ab4cc4c,0x7ff95ab4cc58
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1868,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2260 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3852,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3384,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5096,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4964,i,10167999505013193060,1251545285108310902,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:1616

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4868

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Launcher.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4912
- C:\Users\Admin\AppData\Local\Temp\7zO0333D6B9\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0333D6B9\Launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5044
- - C:\ProgramData\app.exe
    "C:\ProgramData\app.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:1308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\7DLM5quGGX.ps1""
      4⤵
      PID:2400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\7DLM5quGGX.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:8
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pidd2nne\pidd2nne.cmdline"
        6⤵
        
        PID:460
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES224E.tmp" "c:\Users\Admin\AppData\Local\Temp\pidd2nne\CSC9A43F611790E4F9CB64ADA99DCF68F8.TMP"
        7⤵
        
        PID:4364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
      4⤵
      PID:4152
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber
        5⤵
        
        PID:1632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      4⤵
      PID:1744
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
      4⤵
      PID:2252
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM chrome.exe /F
        5⤵
        Kills process with taskkill
        
        PID:3716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      4⤵
      PID:3732
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,19,247,135,40,159,27,225,78,135,190,141,194,4,255,113,93,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,82,59,147,236,199,229,92,161,155,106,207,0,94,64,247,158,90,251,208,78,122,149,225,202,86,6,170,225,134,188,68,36,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,230,243,82,133,69,137,36,172,90,127,119,100,184,218,20,144,199,23,34,245,230,217,237,221,218,26,127,62,20,80,19,41,48,0,0,0,107,217,155,113,144,94,34,152,30,15,92,97,52,95,134,141,2,78,31,39,212,221,143,14,100,3,238,162,33,206,77,36,134,86,229,24,125,254,239,253,63,232,66,221,99,167,7,71,64,0,0,0,194,196,124,76,147,157,192,134,188,20,0,90,216,254,15,201,190,245,208,104,222,254,2,98,47,115,142,9,142,191,190,219,68,31,99,19,70,52,247,137,187,190,191,58,175,60,102,202,107,92,229,99,77,153,24,179,63,153,75,87,182,216,208,54), $null, 'CurrentUser')"
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      PID:1960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,19,247,135,40,159,27,225,78,135,190,141,194,4,255,113,93,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,82,59,147,236,199,229,92,161,155,106,207,0,94,64,247,158,90,251,208,78,122,149,225,202,86,6,170,225,134,188,68,36,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,230,243,82,133,69,137,36,172,90,127,119,100,184,218,20,144,199,23,34,245,230,217,237,221,218,26,127,62,20,80,19,41,48,0,0,0,107,217,155,113,144,94,34,152,30,15,92,97,52,95,134,141,2,78,31,39,212,221,143,14,100,3,238,162,33,206,77,36,134,86,229,24,125,254,239,253,63,232,66,221,99,167,7,71,64,0,0,0,194,196,124,76,147,157,192,134,188,20,0,90,216,254,15,201,190,245,208,104,222,254,2,98,47,115,142,9,142,191,190,219,68,31,99,19,70,52,247,137,187,190,191,58,175,60,102,202,107,92,229,99,77,153,24,179,63,153,75,87,182,216,208,54), $null, 'CurrentUser')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,19,247,135,40,159,27,225,78,135,190,141,194,4,255,113,93,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,166,83,253,52,85,230,81,185,208,201,118,128,213,197,239,182,77,78,36,44,188,134,206,101,108,78,94,9,237,88,153,167,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,254,79,137,170,63,151,199,97,248,142,9,194,26,57,210,153,22,168,166,128,87,238,38,177,170,49,113,250,228,52,78,22,48,0,0,0,152,204,224,184,76,144,182,177,222,117,116,190,71,27,22,62,81,42,167,195,190,51,184,216,228,40,53,2,45,33,17,230,32,148,120,122,147,223,25,172,253,28,208,215,254,102,117,183,64,0,0,0,45,132,158,231,122,14,200,83,57,41,166,99,105,124,196,122,79,203,113,66,173,18,132,82,182,151,238,135,144,83,224,8,79,18,133,96,181,144,252,254,154,54,75,233,143,91,254,149,180,31,252,142,52,252,3,38,231,39,39,21,100,18,224,204), $null, 'CurrentUser')"
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      PID:3076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,19,247,135,40,159,27,225,78,135,190,141,194,4,255,113,93,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,166,83,253,52,85,230,81,185,208,201,118,128,213,197,239,182,77,78,36,44,188,134,206,101,108,78,94,9,237,88,153,167,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,254,79,137,170,63,151,199,97,248,142,9,194,26,57,210,153,22,168,166,128,87,238,38,177,170,49,113,250,228,52,78,22,48,0,0,0,152,204,224,184,76,144,182,177,222,117,116,190,71,27,22,62,81,42,167,195,190,51,184,216,228,40,53,2,45,33,17,230,32,148,120,122,147,223,25,172,253,28,208,215,254,102,117,183,64,0,0,0,45,132,158,231,122,14,200,83,57,41,166,99,105,124,196,122,79,203,113,66,173,18,132,82,182,151,238,135,144,83,224,8,79,18,133,96,181,144,252,254,154,54,75,233,143,91,254,149,180,31,252,142,52,252,3,38,231,39,39,21,100,18,224,204), $null, 'CurrentUser')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
      4⤵
      PID:1092
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
      4⤵
      PID:1068
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber
        5⤵
        
        PID:1180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v app /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
      4⤵
      PID:4364
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v app /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
        5⤵
        Adds Run key to start application
        
        PID:2276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.12OJS2W9ks""
      4⤵
      PID:1100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.12OJS2W9ks"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
      4⤵
      PID:3788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
      4⤵
      PID:4792
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber
        5⤵
        
        PID:4784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
      4⤵
      PID:2252
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber
        5⤵
        
        PID:2516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
      4⤵
      PID:5100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
      4⤵
      PID:3892
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_computersystemproduct get uuid
        5⤵
        
        PID:4860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
      4⤵
      PID:1432
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Description,PNPDeviceID
        5⤵
        
        PID:1488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
      4⤵
      PID:3364
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic memorychip get serialnumber
        5⤵
        
        PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
      4⤵
      PID:2156
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:3612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
      4⤵
      PID:3784
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic cpu get processorid
        5⤵
        
        PID:1960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
      4⤵
      PID:2072
    - - C:\Windows\system32\getmac.exe
        
        getmac /NH
        5⤵
        
        PID:2028
- - C:\ProgramData\App2.exe
    "C:\ProgramData\App2.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\App2.exe

Filesize
202KB

MD5
73f5733f76ac052b15335c1cd985f73f

SHA1
8c4be16301b9da6caa774f800104adf5731b55a4

SHA256
9cf5e2e0f424e7d3b206b17c262a538b29776c34b3fe11fa38222ce8cf7eaff3

SHA512
7acda28d83caf6f27535c0e5e465b6219ba178ad673b0e4af517894c537dd50b7f16d3e83b3ddb7c8c268835eb9fd962902b38e51083a35d0c778aa1600349f5

Download Submit
C:\ProgramData\Steam\Launcher\DSw7AMv4r9Hh\EN-Ylfogioe\debug.log

Filesize
1KB

MD5
9fdbbab30af7f8b3a561a03eb017aeb7

SHA1
3d172ab44e45f1a0e16124971be3896c9907af36

SHA256
476640b7b8da82ab90ab15abe77590905b6939c8f41bcadb9079046138f4b39f

SHA512
76dc200cea126f06efdbba6685e4ca8e0359504284be76454c681816be14a01feb0ef0eeb33f8a3a7185436c123eb29a1e10a679ae62172f1502ea99bd6642e1

Download Submit
C:\ProgramData\app.exe

Filesize
37.7MB

MD5
2b4e3d8483a38b3edb8c5fb6c4ae2377

SHA1
97b61d68ecb640b9c80417b6c5ee3940c1d4807f

SHA256
0bb4106d06534f26e4b1b74627129c7b614339cc9b0eb948200ae739f38321cb

SHA512
737deffa13732a97baa95809b3aa226580c21ad7ceb17ed245244ff7cda0db0e1f0a01a5a9966ea9867b3ef4c6c234b3be76bc90f5bb78c454dc458ced158ba0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8812d0a568257e6048762eef54137c63

SHA1
75a72265c355ff69c15b26263c306d583851342b

SHA256
6976ae3b9b6e860870e3d5ae35ef5df685c3c3a5aa736b2b0ef43a554cb8d7b7

SHA512
ebbb67c94cf8a1b5e87a4a4d7efbd0126c004c1120f17a27418b124215c0949ca5ddef4d527ae3d15b9fa4b727f46e6849df4f2ab1f3341599cf115675700d0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2f794bfa3517206c3f40916ee67bda89

SHA1
33be671a5671d00739647302ab54412ca916955e

SHA256
0c0b130b3fc325dc03835709f06995740947773541cae7772c3910d6ea9a596f

SHA512
6e8d502d358fae3845ae52a1c78ba3a682699a33c8a70013a668952210860aa905bd1697f5ce5faf092707d7697945bd3973797db339d6b249f66de550706f47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c3e69e67b8452a1cbab33ef3e4dbefa3

SHA1
09949d9dec7c7244148a50cb4a634991b5328fae

SHA256
647876724387ad6f906927e2d418c4f4b89a95cef66c68afb2043667d71cd3b2

SHA512
bf8172455c18e4fe81c5a711f2d9ebc6830b86532de6d9fb76b81ac7b0298f67fddb7d018ff702efd08e93b12c870d4c689dad14f0bbb2672b8185b0b9b4c54f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
522B

MD5
9928ee506ac9ff7434fb71d80be8ba1d

SHA1
999e231a54c38636585b3b07d4406843c1f0c37b

SHA256
e3e05486f6aa4c9db3865b3991d31a1d7bd7bdfa756be5974e71ec6fe1af0aa8

SHA512
385b0de2c595eb2d1195f2dce739d147e70cc529f7e4a1bfbf81b193abe611c02be54d6bc4e412bfe425dff40eaf7bf9e686b332d4a42a2f18660072282274ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
522B

MD5
d3f10545b47d7ef156d72b00750fd21e

SHA1
46151f405106fd97c3e72d86f5aa28113f15cfde

SHA256
f2fe58ba8d721ac274b73034e0b6e8a8caf782f6352feef40ff92726ddc8bf30

SHA512
4e1954248c8fbce4313d2b90a1ffcc5916050eb9e7f53f29ffaf049ceaeebdbe751346df49f792526c4512a14a973ceed7dacb447b30459bb06e75712ac908b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
651a5646d96ea7fc3bd2f3e016dc8a0a

SHA1
b8f9a6d806f98b41523156747ecc76286ed84b93

SHA256
e0a05e2fdc43b533c1eae2a1731f51446d469058c702726a1819342a65a5e1da

SHA512
afde713c85b53612b7921cb2b8bd1ff416cba5a436c5b9d6b5b42053ea10c8559ea53d87bb697556e43c4b6be776c3a9b4bb83daeb4119fcb659da8fbc7b4ef3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7f611483d77e94c56371ad24d8ff650f

SHA1
d6b3902dfb82b548f11509bb79c1da8ef840a7d0

SHA256
b86b09f7fc75a09dcca04225018be892c99ec935840360642a69a83455d3471c

SHA512
41d1183adaefff31b9182c75bafc7b23fb6313ee6437342b2ce5b90f4bdecc12ff9c22102508cdf7caa8508fc0918a7d27031df0c9df32df3bd292e564acf125

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
17c78db34cbbe74a2e9632bff6614e73

SHA1
14be5587703823180f4f23013f7629d1f7621d5a

SHA256
8badf0dfcfa4a8d6d37016f866901c19b744c8009e05817080530b86486740ef

SHA512
5f430b19a32a23ea6022f765e19fdb195f3e1eb91d20d97ac0a7cf100a43f5edea162459f6f1a2478832651c53ec457ac0b435b69940e8b12dbde7554fbabf9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
739b22b9f576d51f3784d80aff0b79ef

SHA1
a08a2cf1ae566c0f215c1953e4b56026043f9e74

SHA256
7ecfe596c2e444bd76528430d726ab788bef24c10c55c2ffedafcd9501c80342

SHA512
6a9b4fceb65f1154eb92065c853dc58b45fa42ee9fe2fb80cf473500b7e6b163616cae65a9dbc78c1911131f8137a9c34636d19a7cecc61457dd7989b7c674c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
48431cc6712d99731f610e4cf58a5e9f

SHA1
357a245c1e82ae89991b2e9a410aafcbf65b05d6

SHA256
d7008459e5dae6acfaf177f81cddf0f02c0f7877071aa6fd4ad01d911e0ab947

SHA512
5a1b87cf1737fd058118f1e710ac6bf6935a91c853bca4d4c3e63df1f525c7289e087cfad4bda7979be14ee42aa0671bd3d433a4be372ed857a3813e2b32f03d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d0ceaeab3e8151f205fc5053c0913636

SHA1
24a4a5e557964df2b26c18274e7f4b5cc3e11e83

SHA256
90f0161a4133722bf3fc0e186a6498029b6f39f3179e3ad9a7fd60d3afef58cc

SHA512
dff83190289920b21fb856f5cdbe0b2db8e857b63ebec04de3191c92f3c95d39d74d6a16e882ee3f64430354797c2d0a436b08999dfc60f2e419138905842880

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d8d41dc6476c11c6e789290921320283

SHA1
c7b945d158b5a7bdc2293665fc68b67165c28f2b

SHA256
82e2daa3343d975848158089694d1c138ff937facd890ecc93e74ea7b55325d0

SHA512
d9ce473ab98054f08d916c520ec990ad0e3d187439d4722dfd3a9c5653d3d9251c80ed5f340383988a07a5e752a6e0c721c27dc3237f28de8314fa5fedb463e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
58de217deb74f2b9811ae9c2044b54b3

SHA1
c8d0a33ffde8dbb0fab2f97b5ddf6b6de4d81ebd

SHA256
8982c57ac5ed72d767f84351a262cd38189b8564c40ae178c426ffcc6e911c70

SHA512
95efee8d9fe975f563f4eede0cf58727a2f15bef77d667a5ba7b10f9562ce422c4d426f05efb48d8ab95063a41dd6d6851023b414e41d942091164d374bde483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d12eaab5355e62219a4e57ad3169f907

SHA1
47181f37e8283e2b2bae12dafac4f01b4485242b

SHA256
0d6bb176e75e8038cb3a7b61200f5293ac017a3e74dd31fcaedfb7a842a9276e

SHA512
38033b67022b70232329dc75e0e0c7220d1dd4d144f833097d25c08176de4110126619a5221be4e99b495ca2ea626ba64b46c9241b2e62f7748bf77efdab0ccb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1b80732b1905514b7c0395fcada491ac

SHA1
d113a0e522ad18475b25981b8ade1962c70ff27c

SHA256
8b26a0f40c6be33491d819c2eb789cbdf7625c31ff926c65b413ee71f581cab4

SHA512
a76897e82f7c1bbeebbe205ffd1c4b5a7feb32b7f6833975720e1506d1cf4140f998155eb264b053fb7f5e59f373e78c02c734bcc850f2dc0797217586665aa5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
48ccf978b7272218c12fe4e1074cec7b

SHA1
832269e924ada656eb1b3514f4dcf2b0b61f7c6e

SHA256
69260eb2085c8f65eafed1827bfba7a7eb019515ad241b9b7fb4eea2bfcb2678

SHA512
5d261812d25b72e3d5eff286136a7b3ec428bd1bb141b94a95875c80452075d6d937fe195486de8ddf3c21907c82798a4c15fd766ab63f1e3ebd56a5f85aeb6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
5721647f50ccba51b7187a59a7ca6359

SHA1
69fc5de54e2948977ba45d82dcb6ea341f077f14

SHA256
dedc168ea0080cbc04a936be650474b72189c1cbb5c3129eb91e62718b212339

SHA512
949c8c8ac21f793f283f6ef0fb42dac360311524675fe003bc622ad1676b75973bf69425f8dd54e396c3f9acf5a91fe940b3d709693e11d7f5bad5ec7c1f2742

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
23f2757be9e258fb2a3f5d3c17e67327

SHA1
3b8bbfe1da4812970940dd7ecc4f8cb935abe0a9

SHA256
46aaf0fe292c65e74c1fab2affa0498b1ddaf7c18014622ad1be7a02165aa8b6

SHA512
5db9a1a20ca640575fd87671f2789b46f3239a655ca36b0085e5b525994299cb6dff32e610649ba87541dc139da7cb0f4a4561af9239f2902552ea2178c9747b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1f0f8c49b22409ca78499f5df1ce9456

SHA1
5300f7ed636959c8c8366418e891dbe49a3edba9

SHA256
429128efcec165baf50a81021e610933e1020f5298d865f7b30daf370fb22014

SHA512
ca976a7ab0ef4782c3003433e8d99d34d8060cb3a8790e787b56db1e207902b9dd15ecb6e76fecbd00f5e83a8add34329b25f86b90c62055f0d0d1de5607d2af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f79387492e5d2264cb94e2f480feaf78

SHA1
13f478f478bf824d8cccb611ac9b2645d5523c93

SHA256
f7d942ea9e79af246b7a4e461133ed9434f980e837a8b96f1e35f856ddead9e7

SHA512
c1a16d6c0edeba6659f08ae115b4ed5c496063d9e4339ff0869a85295798fb66281dba43b6de8118bda69db0d34a65966f84c522b9adcf94581934438c015479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
99ae5b177aacf1cd37b1b45cd1cc17ff

SHA1
a4b29799e1fb3afa9ba57e79b52f8cf3814f82cb

SHA256
cf64573a1d18dfa67bf18f53511bfb3c089bcb4396377f195ee5109c2cee4a48

SHA512
91f8ce2998b6e8f96680ae5cb5a4ab62a470513ff91fa7641b64428f945aaffa7ec11e5c1443e619e16472ad6b466a32ee23a88c76f1ce22821c84d8f4be76fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
92a273c6a3f38b73f7b8c6352ec04295

SHA1
6d175fc115df23000e37875dab1086b266cdb57e

SHA256
86d37a78a885bac159106352ddd1ddc5f0e9206afe228964255dbaf64fe82d8f

SHA512
4dda461fadd7b5bceb050e10058ad246702303dbe91b3cae5806278add58f0071861c4934a66e6e586ff21cb13153655d7b9457ff0df17b923aa8964934ffc3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7DLM5quGGX.ps1

Filesize
380B

MD5
cbb9a56c9c8d7c3494b508934ace0b98

SHA1
e76539db673cc1751864166494d4d3d1761cb117

SHA256
027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5

SHA512
f71e0a521c2b0aa034e0a2c9f0efd7d813d8408d118979f8e05ecd3aa6fb94c67793e2302ed9455aad9a63d43a53fa1ac2b3d45f7bdfa1cc8104c9a9ace84129

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0333D6B9\Launcher.exe

Filesize
37.9MB

MD5
2879823979f8b16f80483eb80f38dcaa

SHA1
83846ac4df07519a2fab9952d43ee9be2fdb5794

SHA256
15455df49778d6e1154d788f37171e2e73abc52db4c0b78cde050ad054a23bf7

SHA512
3470ac73d739c805d52ed452bc463f92977d8b606fd4f83e0aab9546e01d55bac27e9faffb20d3f617b6f48476296588e354453d74a32459225c22d716a205b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES224E.tmp

Filesize
1KB

MD5
cce5ed23d66c233d030f66aec6d170ac

SHA1
476d913357b0650ead50b6c85fc25f7848e1994e

SHA256
88de7704f805533f318405d47f6e5e54d8b6e710602eefd0ed8b062bd98cbc6e

SHA512
d8e5e9ead6e933d0ad2f78c2f846fd0ea3b2e87ccecf606dac1c11e64fd7d9d546e5e8c3311726347a8fc7e2e1b1034da328f405fbbe7945186f88d210989aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rawukueo.xbb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pidd2nne\pidd2nne.dll

Filesize
3KB

MD5
380505caccbb92d4845703d97e74924c

SHA1
1cdbcd786d57818ed9f1023b4680871b00a8e6ef

SHA256
d9aac8ca5debbe7c9cc1a74060b64b966776628b3450c75bf786598f3f878ead

SHA512
dc95bf2f109d77d63c2f0706501624a937d91c143cd9a680a20e4011958b03ef3ec16d6cd2bc02be8ed228941382c7b216249d29eb6691d35ed803a5f26fb2a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\Downloads\Launcher.rar

Filesize
34.4MB

MD5
be55d2f7215fe209da00c0403352c161

SHA1
4c807b8e2e1c6dfbcd0d25c891fcf3f25f521608

SHA256
1c7c3cf4b449fb4c86791be82baa6a66de817e2c053a20aa7a300905531e6409

SHA512
1f36141db9054ae8452c1fb6a18568863324f8dba57f88143c63dbdbe196cdab1a322adfc393826b3e8dd30014d5ae05bdc9c20090bbeb9f38914ae9ddc22598

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pidd2nne\CSC9A43F611790E4F9CB64ADA99DCF68F8.TMP

Filesize
652B

MD5
c794a8b70a3666fd03501c7cb481d22e

SHA1
4114a4deeb99c3d4d6710afe310af647da087135

SHA256
1ca9a4086c849d241207a954d211431eaa2fb2b44cff4e3d0aee65ec553ea5ce

SHA512
77e3cd91e46b010ee1a4b69439c0697804a66c6bc2cf66d556c0a8424e92b96c77a24af699caa008dd27cb5b32038788d0ae9cca7b35b81b12cfc1fdfa3d0a75

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pidd2nne\pidd2nne.0.cs

Filesize
312B

MD5
ecbf151f81ff98f7dff196304a40239e

SHA1
ccf6b97b6f8276656b042d64f0595963fe9ec79c

SHA256
295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

SHA512
4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pidd2nne\pidd2nne.cmdline

Filesize
369B

MD5
f44ddecfb6a4cb4fca38961127ab0306

SHA1
6bf1f71d5fe9d3b96af1439a3ac63fce2259759d

SHA256
e13e5c8c8842345b92243295cb19b6f82bdc78da1b72ecdf274980b59ae5f1ec

SHA512
4d3fcac2bd4b1b275387a7e9b1d262ddf50cf06cd59a610bf5bd3d5aacc970f6f946a101a6644ba8b72aea87f02921ddf3b6cf0c2acd834d021ce0424d20bb14

Download Submit
\??\pipe\crashpad_544_POTUWAXAWAYHTSBT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/8-329-0x000002D55D6D0000-0x000002D55D6D8000-memory.dmp

Filesize
32KB

Download
memory/8-313-0x000002D55D7A0000-0x000002D55D7C2000-memory.dmp

Filesize
136KB

Download
memory/460-327-0x000001DA61000000-0x000001DA61AC1000-memory.dmp

Filesize
10.8MB

Download
memory/4220-349-0x00000275285A0000-0x00000275285F0000-memory.dmp

Filesize
320KB

Download
memory/5044-207-0x0000000000040000-0x0000000002636000-memory.dmp

Filesize
38.0MB

Download