94c66d7c5fc0b5319009f683e1b24e140e814af6a843b5c04f9fbd3fd9167e35

Analysis

user interaction
yes
max time kernel
175s
max time network
179s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/04/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
opencode-desktop-windows-x64.exe
Size 43.1MB
Sample260416-vb2q5saw2s
SHA256 94c66d7c5fc0b5319009f683e1b24e140e814af6a843b5c04f9fbd3fd9167e35
MD5 9bb55564db7445de1af27cd0cd53e234
SHA1 96cac00671ef93375a699131a3da32f7466b202c
SHA512 a9e773eab9e5a98cb757df25ecfe0dace4b2f1b6cbc5303549d9dc1477c51217df1491a2708a35f69805a85ebdd2947ab982599aa19eae038093f814f43c36ad
SSDEEP 786432:DIUCEu80EUz/EMRzobv/Pc5QWcgqER9oVVr/rUvx/KkLdCn4FQX3RJ1YdgzPOo:DIUvu8DUz/EMRzYcSzgqPEZiGkFX3RBL
TLSH
T1A6A7336ED957731AD1026F33943196B348E764140304B85AA3B8F56FA5ECD8BF384EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000\Control Panel\International\Geo\Nation	opencode-cli.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1476321089\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_46464216\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1476321089\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Part-ZH	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_46464216\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1476321089\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_46464216\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2716_1460588874\Part-RU	msedgewebview2.exe

Executes dropped EXE 3 IoCs

pid	Process
2000	OpenCode.exe
8	opencode-cli.exe
2580	clangd.exe

Loads dropped DLL 9 IoCs

pid	Process
5016	opencode-desktop-windows-x64.exe
5016	opencode-desktop-windows-x64.exe
5016	opencode-desktop-windows-x64.exe
5016	opencode-desktop-windows-x64.exe
5016	opencode-desktop-windows-x64.exe
5016	opencode-desktop-windows-x64.exe
5016	opencode-desktop-windows-x64.exe
8	opencode-cli.exe
8	opencode-cli.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OpenCode.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
3736	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opencode-desktop-windows-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208320967117815"	msedgewebview2.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\ = "URL:ai.opencode.desktop protocol"	opencode-desktop-windows-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\URL Protocol	opencode-desktop-windows-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\OpenCode\\OpenCode.exe\",0"	opencode-desktop-windows-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\shell\open\command	opencode-desktop-windows-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\DefaultIcon	opencode-desktop-windows-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode	opencode-desktop-windows-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\OpenCode\\OpenCode.exe\" \"%1\""	opencode-desktop-windows-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\shell\open	opencode-desktop-windows-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\opencode\shell	opencode-desktop-windows-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000f749d21a9791dc0141d753379f91dc0141d753379f91dc0114000000	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenCode.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5016	opencode-desktop-windows-x64.exe
5016	opencode-desktop-windows-x64.exe
2000	OpenCode.exe
2000	OpenCode.exe
2928	powershell.exe
2928	powershell.exe
2928	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
4460	msedgewebview2.exe
4460	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2716	msedgewebview2.exe
2716	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	5016	opencode-desktop-windows-x64.exe
Token: SeImpersonatePrivilege	5016	opencode-desktop-windows-x64.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: 35	8	opencode-cli.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2000	OpenCode.exe
2000	OpenCode.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	OpenCode.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 8	2000	OpenCode.exe	93
PID 2000 wrote to memory of 2716	2000	OpenCode.exe	95
PID 2716 wrote to memory of 3908	2716	msedgewebview2.exe	96
PID 2716 wrote to memory of 5540	2716	msedgewebview2.exe	98
PID 2716 wrote to memory of 5540	2716	msedgewebview2.exe	98
PID 2716 wrote to memory of 5540	2716	msedgewebview2.exe	98
PID 2716 wrote to memory of 3188	2716	msedgewebview2.exe	99
PID 2716 wrote to memory of 2248	2716	msedgewebview2.exe	100
PID 2716 wrote to memory of 2248	2716	msedgewebview2.exe	100
PID 2716 wrote to memory of 3116	2716	msedgewebview2.exe	101
PID 2716 wrote to memory of 3116	2716	msedgewebview2.exe	101
PID 2716 wrote to memory of 3116	2716	msedgewebview2.exe	101
PID 2716 wrote to memory of 5460	2716	msedgewebview2.exe	102
PID 2716 wrote to memory of 5460	2716	msedgewebview2.exe	102
PID 2716 wrote to memory of 5460	2716	msedgewebview2.exe	102
PID 2000 wrote to memory of 3392	2000	OpenCode.exe	106
PID 2000 wrote to memory of 4676	2000	OpenCode.exe	108
PID 2000 wrote to memory of 4972	2000	OpenCode.exe	110
PID 2000 wrote to memory of 1644	2000	OpenCode.exe	112
PID 2000 wrote to memory of 4404	2000	OpenCode.exe	114
PID 2000 wrote to memory of 2196	2000	OpenCode.exe	116
PID 2000 wrote to memory of 392	2000	OpenCode.exe	118
PID 2000 wrote to memory of 5532	2000	OpenCode.exe	120
PID 2000 wrote to memory of 2824	2000	OpenCode.exe	122
PID 2000 wrote to memory of 116	2000	OpenCode.exe	124
PID 2000 wrote to memory of 2928	2000	OpenCode.exe	126
PID 2000 wrote to memory of 2428	2000	OpenCode.exe	128
PID 2000 wrote to memory of 2360	2000	OpenCode.exe	130
PID 2000 wrote to memory of 5136	2000	OpenCode.exe	132
PID 2000 wrote to memory of 5664	2000	OpenCode.exe	134
PID 2716 wrote to memory of 5572	2716	msedgewebview2.exe	137
PID 2716 wrote to memory of 5572	2716	msedgewebview2.exe	137
PID 8 wrote to memory of 2928	8	opencode-cli.exe	138
PID 8 wrote to memory of 3736	8	opencode-cli.exe	141
PID 8 wrote to memory of 2580	8	opencode-cli.exe	143
PID 2716 wrote to memory of 1488	2716	msedgewebview2.exe	145
PID 2716 wrote to memory of 1488	2716	msedgewebview2.exe	145
PID 2716 wrote to memory of 648	2716	msedgewebview2.exe	146
PID 2716 wrote to memory of 648	2716	msedgewebview2.exe	146
PID 2716 wrote to memory of 4460	2716	msedgewebview2.exe	147
PID 2716 wrote to memory of 1720	2716	msedgewebview2.exe	153
PID 2716 wrote to memory of 1720	2716	msedgewebview2.exe	153

C:\Users\Admin\AppData\Local\Temp\opencode-desktop-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\opencode-desktop-windows-x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
- C:\Users\Admin\AppData\Local\OpenCode\OpenCode.exe
  "C:\Users\Admin\AppData\Local\OpenCode\OpenCode.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\OpenCode\opencode-cli.exe
    "\\?\C:\Users\Admin\AppData\Local\OpenCode\opencode-cli" --print-logs --log-level WARN serve --hostname 127.0.0.1 --port 49862
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -Command "mkdir -p projects/Example"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -Command "$global:ProgressPreference = 'SilentlyContinue'; Expand-Archive -Path 'C:\Users\Admin\.cache\opencode\bin\clangd-windows-22.1.0.zip' -DestinationPath 'C:\Users\Admin\.cache\opencode\bin' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3736
  - - C:\Users\Admin\.cache\opencode\bin\clangd_22.1.0\bin\clangd.exe
      C:\Users\Admin\.cache\opencode\bin\clangd_22.1.0\bin\clangd.exe --background-index --clang-tidy
      4⤵
      Executes dropped EXE
      PID:2580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --proxy-bypass-list=<-loopback> --lang=en-US --mojo-named-platform-channel-pipe=2000.1152.11035671228119749392
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x188,0x18c,0x190,0x164,0x40,0x7ffe745fb078,0x7ffe745fb084,0x7ffe745fb090
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1828,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2084,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3532,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3904,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4984,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5124,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5164,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
      4⤵
      PID:648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5084,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4460
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4888,i,10969086617671313239,15943029962714382702,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:8
      4⤵
      PID:1720
- - C:\Windows\system32\where.exe
    "where" code
    3⤵
    PID:3392
- - C:\Windows\system32\where.exe
    "where" code.exe
    3⤵
    PID:4676
- - C:\Windows\system32\where.exe
    "where" cursor
    3⤵
    PID:4972
- - C:\Windows\system32\where.exe
    "where" cursor.exe
    3⤵
    PID:1644
- - C:\Windows\system32\where.exe
    "where" zed
    3⤵
    PID:4404
- - C:\Windows\system32\where.exe
    "where" zed.exe
    3⤵
    PID:2196
- - C:\Windows\system32\where.exe
    "where" powershell
    3⤵
    PID:392
- - C:\Windows\system32\where.exe
    "where" "Sublime Text"
    3⤵
    PID:5532
- - C:\Windows\system32\where.exe
    "where" "Sublime Text.exe"
    3⤵
    PID:2824
- - C:\Windows\system32\where.exe
    "where" sublime_text
    3⤵
    PID:116
- - C:\Windows\system32\where.exe
    "where" sublime_text.exe
    3⤵
    PID:2928
- - C:\Windows\system32\where.exe
    "where" sublimetext
    3⤵
    PID:2428
- - C:\Windows\system32\where.exe
    "where" sublimetext.exe
    3⤵
    PID:2360
- - C:\Windows\system32\where.exe
    "where" subl
    3⤵
    PID:5136
- - C:\Windows\system32\where.exe
    "where" subl.exe
    3⤵
    PID:5664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clangd-windows-22.1.0.zip

Path C:\Users\Admin\.cache\opencode\bin\clangd-windows-22.1.0.zip
Size 19.8MB
SHA256 e31e271fe11f6dcd7cf87ca74be4a12788ff8ce5a0b07762583e335c058e939a
MD5 718629b87f627c7b1fab46a3de21037f
SHA1 83ba3e473467394f8806194683fcd799b0e37f4f
SHA512 c762895ed2d51adeb0e548a9d5b54b0d2287e3b270f0d35783103330e6c498ff1e4af6ea2c92f1178a8a32241f57f3394ca2de46f2da2a0f8be4df789a859d0c
SSDEEP 393216:hrM2q/p+ETFuftXqxvZ3nNWfkV2zFqnZArJzLjwkqscJCrIFgRdsFocODINXvT:6P/pJ5uFXAZXNWfkV6CSdPjwnscJCEF1
TLSH
T19C2733D3592E3BD3E055D9B8709341F8B1BFA60B2FF530969BD506E55C0934ECA222A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clangd.exe

Path C:\Users\Admin\.cache\opencode\bin\clangd_22.1.0\bin\clangd.exe
Size 47.7MB
SHA256 c89ac15a782de21e182d5a7acddce31f2fc8984b1c7f4218cd84ba67ff698d96
MD5 3020a07a25dda03ed8b27d82b31e53af
SHA1 25c718798c05496fa14319398c6e92d27bfb0020
SHA512 484064bdd31c6bd00d0998f940da60eebe85356b1f9b18807027741b5df7dbbfe3945d8fb5baa6702e9b4f85805254c36324e1a2dd368b02c2ab42eedd2b4954
SSDEEP 786432:IcoAtJmeIU+SNcIRMUYflB1M15R57r15:hlt89k1F7rb
TLSH
T1BFB79D5B72A411E9C4BAD178CA1A9907FBF174450334ABEB1AB086722F13AF16D7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\.config\opencode\package.json
Size 62B
SHA256 95be083aaf52d6a4cb7a01bfd95a47802441fcdd52a34373cd09c2bfc0722547
MD5 ac29eca972f9638b12df179b33813fe5
SHA1 d49d09d27ce23bc9d4a38c8d846d00c9777c4efd
SHA512 147ad56089db26c8c4c007f92085bad715633b5ae54c1f3d8476050f7edf8fc1c6cc8f875a467162f10aaeb1642184700702fedeac6a4a8b6acf9279bb103974
TLSH
T136A02230B00000E28EEFA0C00088C323880EB808C0088808A0E002CCCC00AB2008C220
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
TLSH
T18A51DB313375B1E4895A7F47192819C023BF8355FA98AF5CB65C621ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 231d1c8a68eb550bd0182b4e0714a9f7ff98feaebd331c2cad040e67bc69ee4c
MD5 94d20eab2cd0a0783e70e8a3270b4aa4
SHA1 c0a2d056c40cb6ea56da698e1bfaa8ed5f5349d9
SHA512 c3eb3a9e07df65a3f4b96427d98e600059d8fd4b271897ef366396f045443a94e35898b7223f62723747b9c0d17207539d3b4624d1c214e281d376f739317eb5
TLSH
T144411698A6E91148B7B76E56ABF6A86E187EB9372F07D45E10110F8F4662B00C861733
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 041d3d535c0933724bd0cfc107d0b4df1c3117359a5c4f7eb991320a934948ca
MD5 8e4ff471bb2d5cb4412377da6725e476
SHA1 e6e092582b144f564ed2e93bbab786f5d1480b3c
SHA512 62e973f2dd83e20d6b967f69aa6cdea2e648432fbbf0c300f12a1208c33911c8529808124f5f68b62a43943b18473b6bdb15da3bfe1875a501a0b4e6628a492d
TLSH
T111115723F79CC961CC99423B409C9DA175B2D7C7809EDE9B6EC4C205A07F599DB21190
MD5 SHA1 SHA512 TLSH

Submit Download

OpenCode.exe

Path C:\Users\Admin\AppData\Local\OpenCode\OpenCode.exe
Size 24.5MB
SHA256 f41933922dca39e822180d417b2d55ae549670a47cfc20d2e5d32412cfd4dcc4
MD5 5aadb61a90706294ed031031591fc5e0
SHA1 1bc316701d43648ef3f2e5bd66967fe952111d62
SHA512 21129a17081011593bd7aba74a6bdd2d2fea739c5fddc3c61bfab56cb19cda199d2ecc048f019079bf57080fdac8350675b2ddd2f17d786161dedb42ebca97c8
SSDEEP 196608:jNMdADGKNSoTqnDkzMtW34mjBPzEDoQpONOWopELXcb+U+5C7TH0:BMdADGKNR+kwtklpQaopELMb+W30
TLSH
T1924728217B5A996CD05BC474834B8A724A7170EB0B35B9FF448496382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.bebef5e3dde4bdbe-00000000.dll

Path C:\Users\Admin\AppData\Local\Temp\.bebef5e3dde4bdbe-00000000.dll
Size 1.1MB
SHA256 1c51f4bd5e5a61a9e3aec69922de6f0da92db82aa3a936abac2a4e02ac155d57
MD5 86940db044ee98a91174b10e7d1f0363
SHA1 0e9db4cf937a6ab17a40e8b3f06e839dc69e42c3
SHA512 befff4a42ee331fa1a340c0224897fde7a5962102d6d59eeb9f8de51fc677fd3430cbeb3f4bfc4b5ad33bc16c709b5f0091095b62920f0b4e38fedaaac40dcd7
SSDEEP 24576:aIp2C9qdXP68TPtiGFrZwFelnwqESQT+:aIp2C6P68pNFrZ/lnwqEv
TLSH
T19935E507F2A29D7BE01E807041E756D2D2FD76498300E8BF91A05A2C1E978FB5B747E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.fea7efe75f47efea-00000001.node

Path C:\Users\Admin\AppData\Local\Temp\.fea7efe75f47efea-00000001.node
Size 506KB
SHA256 a8199cf7b6c5102267a5889f80321a4cc92e631d7504c474d32a35b4d440f315
MD5 34581748f55c388cd744f152e065bd0c
SHA1 95c5394ad0a174184b808c17d1eb5fc71593d7de
SHA512 b5b8ab91947a2b06bd7ef097855b0cf19dfbf3b9e93b33d02b57cbdac4ed0b7d82004665123a1ee6c5a880b80d7cd9df9ad202fa179731b2045b0ae11e1c69f3
SSDEEP 6144:jk4bH+DHWwaMfPvMpRIO8kM4dac5mlMH1BVLI6vuLlKIdM1sj3vy8BK:N+rWgcc6hdac5mSrVLIUuLlzqsDpU
TLSH
T19BB47D6AA2A803B8D4ABD17CCA574903F77578460761DBDF03E086761F27BE15A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wgiviunc.iki.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wgiviunc.iki.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc2586.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc2586.tmp\modern-wizard.bmp
Size 150KB
SHA256 501dab1812b60400b32a9ea90626314857af4189721a1711fc5764d293a0378b
MD5 490de030cec079a67c7b8f23c90bf9ed
SHA1 8a2a7cd78b457ef5ced2ae968b176a9a559480d0
SHA512 d5e64d5ee45fca7fe9099356a2e4a5ba83a0c6d42ebce3731a9d0e247e0801413a31d81d34858d114ec1bb8df3b53416ef7effdb301a75b1bd23244952b837f8
SSDEEP 1536:l1nF0t5cL5qeQhVYEUIYdwzoK1ZbVmOWcc7pDrFgmtosWqjHCRO:eCcc7ZrFVd
TLSH
T154E3CC92BF4AA986D3D18832711376498B827A663E73CD7B247C3C59C63ABF11D1C643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc2586.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc2586.tmp\nsis_tauri_utils.dll
Size 48KB
SHA256 d0c1ada1a9b35c37fb1be9a68645258bc5d196d22f2585d6b728248a015abf04
MD5 6613c194ac9a5456ad7f1e400d7f5adb
SHA1 de62aad8885702bbceac185147d7400fff55817f
SHA512 fbffdc1161dcc9e6616fec71451ace2c69f362b4d7c540ed15880180cca68c3d95880a2a2cb0937bd12f147bc9cc17a39d548a8dedd0d478b81e18044f330600
SSDEEP 1536:vwODZzTrAV5Oevq4DtXHVGstzxtzgS9UfIkhD:vwwy0gqaXHMsxxxHK
TLSH
T119238E89FDC46A67E7CF15711084CAAB6E3FCA061600C95BE2B25ED2C482772AFD511F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preamble-435baf.pch

Path C:\Users\Admin\AppData\Local\Temp\preamble-435baf.pch
Size 260KB
SHA256 cb95d8576736c0e282e649b37aa4dfec887c885da21d376c50c62f980d2c8d06
MD5 f6f14c58bde0f26cd0f677e0ea21b1b7
SHA1 b010e33c9f93bafd2b65d6cd5f4b6984117d438f
SHA512 d4971648e4db3e4c69da6f5e60a3c836a3126f2372f85adbbdb1edf19be3bf9810faac5a3adcc2d3ecceb022b92ce246490c8d4eeedeb5a3a372e72acf1d8a7e
SSDEEP 3072:CGYsW+/qFcZAjCdeSu7bXtbaaygkwtH4kY8aZB/B3dSsGQDiE3daD8ABjJVXZpj:wsW+QCMSGbIpBBZ3dSUJOLjJ9Zpj
TLSH
T132443A94FB8AB611D4A5B077D4FB23EDE61CCFBB7B8746C53DC400282C533A1499A298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ef953106528284163941976eb486ccdbaf286b418399b79db083f830f5380a4a
MD5 de589086f0e467a1f08f50066812d7e8
SHA1 9be9ec47754b0d0a991f08131bc69a0ab5f15a81
SHA512 6384037154b1a8576352fc8e26b58814ac4a01cb3e8d1de0ccfb3ac7364c5ae66887da25f7eb829c0c274dff9fb91cd1566a97f2c387915c572989f2b50cb0c5
TLSH
T115D02B1732120E30C43034B71101B2593E10CB0A849380411C2B490F4FA40D33EC35C8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2453afef41e43fb8277920a8d13266675259b82d33cdf60df6f46a2843fb4cc0
MD5 7ebecdbbc8f2dffe41b75518d9239a80
SHA1 8081fb982b67ca150ed87c4613a0322c833bf2cf
SHA512 ffb06e105a9def933cc53f85331dc5d7286ebf7565a5b48144d481df2cee9793c630aee65980436dce5c4cbac3b528d3b7e33a37db10ebe7874cc9e463eb6c1f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 241e6274856b397fae4874da52624a714eaf4403c4cdf91440bd94ab93adadda
MD5 a0470383eda8c23d1def6224385652e9
SHA1 47a9bfd4a35031b2e0f5b1da59308a17cf1d9e97
SHA512 9bb8db12d438a19a2ea1364698254d4e0f94e2adb82fe5ff76c46f6d0bd5e2105ff81966d6098d3fbf3ff2c6bc90b1cab25d5ff07605429efd4fa6d14e3e8d48
TLSH
T166D0121337450D34C03021B3100275581500CB1B8045404064298E1D1F480552D034D1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 10eddc908881b92361a9ad8222876adb98cc53c7ace37de49cef82e517b90b29
MD5 137298f34512b45f86d64e1a9740e5be
SHA1 07bd021aa2e8f27a24b06aa00af74cffa30e9fce
SHA512 9d9ba6a441ca2ee5e7148703cd3d17a3dd028ba0314f6c55474492d0663da470c69709b04724afe9c20a4c73a43dbcb64988495b82c8a26880c4e8f761565536
TLSH
T1E1E08C650EA9E482F318143843CEA401B2B4791383338FC454CA847D65B1F652112216
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 53645b2ffdbad9de6c28fc057dd741be32bf3528a978552ba26a95be71f772b2
MD5 1b4019435c875f5a11253532ee8e8387
SHA1 8b223e4732de55df775fe56e2066ec5659229f04
SHA512 12587be347d3dd115e2fa00192d3bc9de48c1b805d72222ecdcd7872c536e058955ae65cd432ef14fa219b330e00f2751a33aa680a9d12a2dbb7a367b159d24b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 d62430f2701e88a2c17d44fac1bd96c0cc7fbcc48cebd19ce2dd004d34d1fb16
MD5 00df9c42c62e2ccc2684fd7c07706cf3
SHA1 407d7a02603ec7940ca369998627c0233368ab16
SHA512 1416119eaf07f99b8cd2c8c5fe6225e6d63031c1d3c73c493ba3ce0cd8384e5fdddb645b8285b0bf4c9bd166034fe8006ea88c4e0de884e19a58e156fa4c6ec4
TLSH
T130F027650E6AD846F308053A67CDE001F6757503C67F8FC550C9C0BC4ABDB562103D18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 73144f5b719b8e9fd66e9c30623dc35b1d4850574dca729093c3c1a9412042bd
MD5 b9f3e020d913e9a93678ce3abf4aef81
SHA1 ee4852c5bfb14d8d5ca1f263e5e7f45822b72060
SHA512 bb120490b7a6ca1a38f3e226e66a9133f04346a1f783c82f3d5759a443e40f2d21390975cc4dd966b5903790080ff630b9a9b1bdd718d15813ff919dc098836a
TLSH
T1E8E0A7650C59C943F304143547DD9001B3B45D13C2770FC564CB447D4A72F9D3261720
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a917.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Network\Network Persistent State~RFe59a917.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Preferences
Size 6KB
SHA256 26580c914104e91443bd26305b891b2a15d9e6d32b48a79943bd50bbce45fe9d
MD5 f09d0e863f836b6b172c602431dc7703
SHA1 1cfffdbf81596a462c68fbdfbd2ceabcf160a26f
SHA512 348617a27f6bf74378db05dd3ebb8f8fac64c9df302742bdbf35261bbeb4d0654be29db99808e07f98de5cae3572f428efc3312a8bbf120d110aa7f200c0c543
SSDEEP 96:stW05CLfpb9BdffmZ8i0vhE+ktTm/7qx+WVHMSm+uecJ9SMk8dQj2+gHl5yMOB:stW0UvfOZ8pali/S+WiT9SQdLn8MC
TLSH
T142E1A8536F28A9774CCBF719BA35BB56D6FA107262D40E58EBFC860C04D66CD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Preferences
Size 6KB
SHA256 0cfbcba2a59353da21ba31b69bb9865ce35cffe174588b6bdc7594bf8e336749
MD5 8c26088558beb173292c75ae199bce25
SHA1 59f7f92406056e2a2d1c1e3cd73af82c046c1fb1
SHA512 fd91499702c57f8f574b39fcd57d2f5bb392b389bb1d8a5c4f3995de2d71b1d039f51ba93ca89967517c6eeec7f9e75603e619e2c6c502b5815a5fe5c0b76ef0
SSDEEP 96:stW05oaLfpb9BdffmZ8i0vhE+ktTm/7qx+WVHMSm+uecJ6oYEpdQj2+gHPE45yMQ:stW0VvfOZ8pali/S+WiTbYWdLR8MQ
TLSH
T1CCE1C8436E28A9774CC7F61DBA35BB56E6FA107263D40F48ABFC860C05D66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Preferences
Size 7KB
SHA256 3b153fec08710793080b1962c7a6a353b0dabe7babd16113c4925cddd0737f6c
MD5 c7fe7154186b651a2ff0f10b88693b8a
SHA1 86112f945837ddd5a7015ed0b19071e687e43944
SHA512 97cc94fc179a148875f75a37a1bf6e4f3d8a78db9ad49a8e9f8233901d47004bf3d21451b28073476c013253d9087a4541a791d9e3ef4054de8690f09d3f5792
SSDEEP 96:stW05oaLfpb9Bdffq5Z8i0vhE+ktTm/7qx+WVHMSm+uecJTYvgdQj2+gH8L5yKAB:stW0VvfAZ8pali/S+WiTTYIdLQ8KQ
TLSH
T189E1DA136E6899774CCBF71DB935BB56E6F9106253D40F48ABFC860C05D66CC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe591ddf.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Preferences~RFe591ddf.TMP
Size 6KB
SHA256 1be4e26734ae4b08959810278ac279f13b82699f50ef5682ddf28d88b9ee750c
MD5 7125f97e55f354408d3e2ddd5774bc56
SHA1 a48b769c919d2b66a8513c5dd4bfd1286274012a
SHA512 5072a57c37881a43352bd14bc0309732edfe640726614355dbce656f9ce8956f0e99b7f046f4ed4f7932bb80066e933f3845f9c449a21683f9375162e387a5e5
SSDEEP 96:stW05CLfpb9BEffmZ8i0vhE+ktTm/7qx+WVHMSm+uecJ9SMk8dQj2+gHB5yMEB:stW0UqfOZ8pali/S+WiT9SQdLf8M8
TLSH
T159D1C9436F28A9774CCBE719BA35BB1AD6FA107162D40E58EBFC860C04D66CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 17KB
SHA256 9b5e279416a2ef4412cf33d9ba6fa570355663f2bf551d54a6e186cd963eb04a
MD5 b704070736cc3db594ccceb572642a76
SHA1 9412ac0dcb2a4cebf0d418d9c04e8c51beecb223
SHA512 75e8bf71d0c88dd523f9c587ef35d491f1d97268a7a1423d5e8741a0947b7409b01b0ce829f7912811f6b996c99c73d32d0b98101cc13846b5d1bd9b88a2f172
SSDEEP 384:zrfRE5BdEZfr0kuh9Rt/nP9yo3NgFNuLyT7K2mNvcCQZ:fRkurqhNsogcNvcCQZ
TLSH
T135829D72D971E823ACFB86467A0A6B06A6F0814965C55FD4ACDD1F0C0AC7BDE1363C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 1KB
SHA256 7ac2354c4c9df5e5e45f85bee1b2eb2a6d11e057f11e689c4308157443c1e93b
MD5 dfa9408d165e13c76f422cf4c0ba9c00
SHA1 b6be19d1ee1482ac3082dcaf503d7cbabb9a885c
SHA512 4c13669a2eec5c9dee9b5c114c6fc31ecafbf1f707cececd4f00450a15c90c11cc8542d01af7ae09b8472a860446e2a2fe204daf393b7680f08251a593e107e1
TLSH
T1D7316272F4946F725DAAA245F2962F5B2E32406B82504F48A1DE4B0C11EB2DC9677C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 2KB
SHA256 93c563a6f9b32cfc4fbba51bd9b037cc45a989da47d2ef3ed07a54a49a553c76
MD5 bd28bedb355dc4c80fa9576f197286ab
SHA1 61f467958af16d9c9dc9e109f56ca7e636a957d9
SHA512 57b7688a75525f6fcf6e18d91298b6492967a07b924200ef2494e383c0638bcc6fff675dbdcd972e7a1708ff8d433ab6ed3c4eb5fbd34e1899bc41d05835c545
TLSH
T18D51A533B858EA738EF79744F99A3F275E3A40AA96911F5495DD0B0C01DB29C2352C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 3KB
SHA256 97b8a51d4f45e9bed80ca87e34107c1f919905378ed3df49eab872bc69e5fa24
MD5 acdbe0a490263df379868e10d85c5369
SHA1 05f781f8c8b85fb1a1f98437e6132946cc20cd14
SHA512 40dc9ee9ead999186943e0c4734d6ad4cd11198e8658560ea66a5aa2ae3e1fede3186341d13cdb2abe2c1cfe258e6307b3c3fcb19d7dad3e6e10e2ab07930a29
TLSH
T1B0717336B968E9374EB79A04F8862F1A7BB6412BD5912F98D5ED0F0C01DB3D81352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 16KB
SHA256 ab64d41acee8de685e269afa283abca3daef844f23b091c995c10d875290fa53
MD5 568e83cebb4d3c7c8cb6f7a9830ba98d
SHA1 7569d9d97351c3720fddb49f295683d7b54d5405
SHA512 c1feee1455fe1e130cdcf15eedddebfe897719bf8fccc529d1c2aa085c50b8cc144b32a85cd1ba4f49914b9eada09185c489f7c099095f232e2667b982ca4970
SSDEEP 384:zOfRE5BdEZfr0kuh9Rt/nP9yS3Nb0N9CT7akCQZ:6RkurqhNsSFykCQZ
TLSH
T19D729E729A74A8335DEB820A790D1F066AB5845E95D16F947CED1F0C0AC77D813A3D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 16KB
SHA256 f1a76defcdc8eee5c9a0138bbc7c3679721e09110a00d5c15687b29e7b59e5f9
MD5 1f33b71940848367ff149ba2869f9a4c
SHA1 53e8313b1bee878aff06bdc8983c4ca8f7c9eaec
SHA512 00c40fab367e61192a0638d7449659d251c5b5e4a2b3415a0e1f1029211dc909f72fbfb8ae626800fa37a4fae3cff7cd3a020bc9e7b3ba4b472ae48fc788408e
SSDEEP 384:z1fRE5BdEZfr0kuh9Rt/nP9y/3NbFNICT7akCQZ:9RkurqhNs/xykCQZ
TLSH
T1A972AE739A74A8335CEBC20A790D2B066AB4844EA5915F947CED1F0C0AC7BD91363D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588085.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State~RFe588085.TMP
Size 1KB
SHA256 0ad05865438d108b58b318d09a40a6bc9cd42648ee80ec15124e0559c7296d11
MD5 309ae79ccc3ca871ef212867a3ed2393
SHA1 1d49c208c5644af801acd1ecfbcb0915084da218
SHA512 a8154f2418ca0bc17e51e25dbea2ec46a49d03ab6746e614b8643ba3c0a7389d2f99cb5d1b5132ce9de8911f122feeaffd69dddf10259d9a4777e2fe34b75580
TLSH
T181216272E498AE72AD6A5245F2627F8B2E61806F82508F0CE1DE470815EB1DC9677C33
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\RevisitationBloomfilter
Size 392B
SHA256 d1afeee5c240a7edabe9a73c4407fb5399eed22fa851173be9f4f3e3c93f8b36
MD5 3c3633e6215e00311dd9a385350294ae
SHA1 b0b7b5ab10d4baabbb4625ec3fcc4e9b0f15c844
SHA512 52161ffc5aad9e16a8d0e0c969fe9754b1625494c916e31e500471627269ed85957eef1f18756ba28442eae031e41e824836b3306567c0904fb43963ad612ad2
TLSH
T1F2E00297D700E4AAC02803709A43272437D2C13442F157456B44415A1C266103D56686
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\RevisitationBloomfilter
Size 392B
SHA256 be37d852e26eaef7ec20e53e790b42387b63a4ee89b376e4f0e5c8badf7eae06
MD5 365015713dcb1690726a3d80f7d1576c
SHA1 1b76179b67727124bee58b887dd4a28a2944d4ff
SHA512 3abb6cea97975b9a2334232be94b92e9c54dc2b7812af6478d2e82a5e0f070be78f08dc79bbd7bd51d2dbc8bfd173b8d1c334bb9dee1ab644d956f631e61ed99
TLSH
T1ECE002529700A469C0280170894313243752C124438157456A0401554C246101D56885
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5956b1.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\RevisitationBloomfilter~RFe5956b1.TMP
Size 392B
SHA256 ca7c5ce949955ae7763f99f0dc2b0a391d75d3e9c05abe18de7ae5ca2c9766ac
MD5 ce7f8a38250a892c3c54631aa67a3921
SHA1 31aba47da74eae8a4d720ae98349e51a83cfab0f
SHA512 6d700094a08f69399e43a98431ecb0e0b18e7e491f8e5382d2b0104e71d9b982d035dbd4503e8be5ff781e8d5b8f3cb73b59f15c08d92b8084944f5b44fcfb72
MD5 SHA1 SHA512

Submit Download

opencode.global.dat

Path C:\Users\Admin\AppData\Roaming\ai.opencode.desktop\opencode.global.dat
Size 11KB
SHA256 c85e8d43ff338830445bcc85cc4673a3ae49614671c90497080546a08e2034c9
MD5 c80b6ffda41117ecab6b039a23c7c2a4
SHA1 5b602aac638b724172dad0edb8259c48fab19cbf
SHA512 4c91740553322d04135fc8b93adfc23fe791db926c473523cd0173c7de6b3056aefbdaf219d6a3c8668e992ae1b2dd5b549e64885981a22dc6ebb8dad8756c62
SSDEEP 96:sab7Xseaym3FOjQlv1vFv3vlvZug1SpQ5BT1Ja6RHqqGMCBG/T6tCv1A+ZajYSyS:sI7Hm1YQIjpIlIBku8bMrcVe6bvru
TLSH
T19C328A2BF61CDF95F2C09D9F16F81C39761AB14450C37CB9E492CE1043B58B8D6AEA61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenCode.lnk

Path C:\Users\Admin\Desktop\OpenCode.lnk
Size 1KB
SHA256 4b35e45fa6a90b933a795b338dad8e0ad2db79a7517d583efb77ac21156b8899
MD5 ada9db67bae35fdd83e2f0ed93eeba57
SHA1 fd5d19b58df17c8b02cd63ba95e9cf0c865fac38
SHA512 21f741eecd3d86a7566bad31c9339b62d6bfc336c037ae6fb86702777faa6f9f80e6aff1525cf602ce4117253c5191c45ddebd2ec6f9df087b3b0f3e4b42e48c
TLSH
T1E8211216F9EE0B15C2A6AA7612FA1726953CBC25AF014D2D01C482041C496C15C8FFBF
MD5 SHA1 SHA512 TLSH

Submit Download

main.cpp

Path C:\Users\Admin\Desktop\projects\Example\main.cpp
Size 95B
SHA256 32343f917c5d02eb9f06bec02c9c4b1587f2c10f3e549d04144b9b97c9329a29
MD5 d255327a4e2c0bbae100229035ce9dc7
SHA1 6f21d6fa2df7e4dcc2562bd4bbee3a976096c2c9
SHA512 f26131f3e5f383d293ec735d4df626584bce9b938503f0a3bf19a945b32a03b10162b83cd42c58f3270e415751c62e55d7da5781a53778d095c1cc3c36791eb8
TLSH
T1FFB01210CCFD6C540906C9499234514060870507CE1C5701550255937F0040270FB3F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-892-0x000002D0C0B70000-0x000002D0C0BDB000-memory.dmp

Download

memory/8-561-0x000002D0C0B70000-0x000002D0C0BDB000-memory.dmp

Download

memory/116-672-0x000001E178C70000-0x000001E178CDB000-memory.dmp

Download

memory/392-669-0x000002005AC70000-0x000002005ACDB000-memory.dmp

Download

memory/1644-666-0x000001EEF1510000-0x000001EEF157B000-memory.dmp

Download

memory/2000-1827-0x0000017A6D7B0000-0x0000017A6D81B000-memory.dmp

Download

memory/2000-560-0x0000017A6D7B0000-0x0000017A6D81B000-memory.dmp

Download

memory/2000-732-0x0000017A6D7B0000-0x0000017A6D81B000-memory.dmp

Download

memory/2000-891-0x0000017A6D7B0000-0x0000017A6D81B000-memory.dmp

Download

memory/2196-668-0x0000028AE1B60000-0x0000028AE1BCB000-memory.dmp

Download

memory/2248-173-0x00007FFE92850000-0x00007FFE92851000-memory.dmp

Download

memory/2248-172-0x00007FFE93370000-0x00007FFE93371000-memory.dmp

Download

memory/2360-675-0x0000015CC1050000-0x0000015CC10BB000-memory.dmp

Download

memory/2428-674-0x0000022F34840000-0x0000022F348AB000-memory.dmp

Download

memory/2580-1571-0x000001CFEE320000-0x000001CFEE44B000-memory.dmp

Download

memory/2716-1891-0x0000027A9CB20000-0x0000027A9CB5B000-memory.dmp

Download

memory/2716-1890-0x0000027A9CAF0000-0x0000027A9CB19000-memory.dmp

Download

memory/2716-1889-0x0000027A911C0000-0x0000027A911EE000-memory.dmp

Download

memory/2716-564-0x0000027A9CAF0000-0x0000027A9CB19000-memory.dmp

Download

memory/2716-563-0x0000027A911C0000-0x0000027A911EE000-memory.dmp

Download

memory/2716-565-0x0000027A9CB20000-0x0000027A9CB5B000-memory.dmp

Download

memory/2716-562-0x0000027A932F0000-0x0000027A9335B000-memory.dmp

Download

memory/2716-1888-0x0000027A932F0000-0x0000027A9335B000-memory.dmp

Download

memory/2824-671-0x000001402E350000-0x000001402E3BB000-memory.dmp

Download

memory/2928-900-0x0000021B5DFD0000-0x0000021B5DFF2000-memory.dmp

Download

memory/2928-910-0x0000021B76150000-0x0000021B761BB000-memory.dmp

Download

memory/2928-673-0x00000233703E0000-0x000002337044B000-memory.dmp

Download

memory/3116-165-0x00007FFE91E60000-0x00007FFE91E61000-memory.dmp

Download

memory/3188-1857-0x0000028312940000-0x00000283129AB000-memory.dmp

Download

memory/3188-580-0x0000028312940000-0x00000283129AB000-memory.dmp

Download

memory/3392-662-0x0000025F15420000-0x0000025F1548B000-memory.dmp

Download

memory/3736-1536-0x000001D0D2AF0000-0x000001D0D2B5B000-memory.dmp

Download

memory/3736-959-0x000001D0D3000000-0x000001D0D300A000-memory.dmp

Download

memory/3736-958-0x000001D0D3020000-0x000001D0D3032000-memory.dmp

Download

memory/4404-667-0x00000259A0270000-0x00000259A02DB000-memory.dmp

Download

memory/4460-1625-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1614-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1619-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1623-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1622-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1621-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1620-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1613-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1615-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4460-1624-0x000001CB151A0000-0x000001CB151A1000-memory.dmp

Download

memory/4676-664-0x00000290F1C80000-0x00000290F1CEB000-memory.dmp

Download

memory/4972-665-0x000001F0E6600000-0x000001F0E666B000-memory.dmp

Download

memory/5016-28-0x0000000000910000-0x000000000096F000-memory.dmp

Download

memory/5016-59-0x0000000000910000-0x000000000096F000-memory.dmp

Download

memory/5136-676-0x0000019FD96A0000-0x0000019FD970B000-memory.dmp

Download

memory/5532-670-0x000002A4F31D0000-0x000002A4F323B000-memory.dmp

Download

memory/5540-90-0x00007FFE91E60000-0x00007FFE91E61000-memory.dmp

Download

memory/5664-677-0x00000262D21E0000-0x00000262D224B000-memory.dmp

Download