salatstealer | hxxps://github[.]com/craftpedro62-debug/_s/raw/refs/heads/master/sass/utilities/randll32[.]exe

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/craftpedro62-debug/_s/raw/refs/heads/master/sass/utilities/randll32.exe
Sample260504-tbh4csa18m

Score

10^/10

credential_access defense_evasion discovery salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 15 IoCs

resource	yara_rule
behavioral1/memory/6024-87-0x00000000004C0000-0x000000000104E000-memory.dmp	family_salatstealer
behavioral1/memory/6024-104-0x00000000004C0000-0x000000000104E000-memory.dmp	family_salatstealer
behavioral1/memory/6024-124-0x00000000004C0000-0x000000000104E000-memory.dmp	family_salatstealer
behavioral1/memory/748-126-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/748-136-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/5824-161-0x00000000004C0000-0x000000000104E000-memory.dmp	family_salatstealer
behavioral1/memory/748-162-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/2364-182-0x0000000000F60000-0x0000000001AEE000-memory.dmp	family_salatstealer
behavioral1/memory/4652-193-0x00000000008D0000-0x000000000145E000-memory.dmp	family_salatstealer
behavioral1/memory/748-253-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/748-254-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/748-255-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/748-259-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/748-261-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer
behavioral1/memory/748-262-0x00000000002A0000-0x0000000000E2E000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	5108	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
6024	randll32.exe
748	csrss.exe
5824	randll32.exe
2364	csrss.exe
4652	csrss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
9	raw.githubusercontent.com
14	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002b453-76.dat	upx
behavioral1/memory/6024-78-0x00000000004C0000-0x000000000104E000-memory.dmp	upx
behavioral1/memory/6024-87-0x00000000004C0000-0x000000000104E000-memory.dmp	upx
behavioral1/memory/6024-104-0x00000000004C0000-0x000000000104E000-memory.dmp	upx
behavioral1/memory/6024-124-0x00000000004C0000-0x000000000104E000-memory.dmp	upx
behavioral1/memory/748-125-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/748-126-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/748-136-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/5824-159-0x00000000004C0000-0x000000000104E000-memory.dmp	upx
behavioral1/memory/5824-161-0x00000000004C0000-0x000000000104E000-memory.dmp	upx
behavioral1/memory/748-162-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/2364-168-0x0000000000F60000-0x0000000001AEE000-memory.dmp	upx
behavioral1/memory/2364-182-0x0000000000F60000-0x0000000001AEE000-memory.dmp	upx
behavioral1/memory/4652-192-0x00000000008D0000-0x000000000145E000-memory.dmp	upx
behavioral1/memory/4652-193-0x00000000008D0000-0x000000000145E000-memory.dmp	upx
behavioral1/memory/748-253-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/748-254-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/748-255-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/748-259-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/748-261-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx
behavioral1/memory/748-262-0x00000000002A0000-0x0000000000E2E000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\csrss.exe	csrss.exe
File created	C:\Program Files (x86)\Microsoft\98fd7c20-9d3e-30ac-8d02-e34cf571209d	randll32.exe
File created	C:\Program Files (x86)\Microsoft\svchost.exe	randll32.exe
File opened for modification	C:\Program Files (x86)\Microsoft\svchost.exe	randll32.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe	csrss.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\randll32.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	randll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	randll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5108	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223835829764196"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\randll32.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
6024	randll32.exe
6024	randll32.exe
6024	randll32.exe
6024	randll32.exe
1776	chrome.exe
1776	chrome.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
5264	powershell.exe
5264	powershell.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe
748	csrss.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1960	1776	chrome.exe	79
PID 1776 wrote to memory of 4180	1776	chrome.exe	80
PID 1776 wrote to memory of 4180	1776	chrome.exe	80
PID 1776 wrote to memory of 5108	1776	chrome.exe	81
PID 1776 wrote to memory of 5112	1776	chrome.exe	82
PID 1776 wrote to memory of 5112	1776	chrome.exe	82
PID 1776 wrote to memory of 3380	1776	chrome.exe	83
PID 1776 wrote to memory of 3380	1776	chrome.exe	83
PID 1776 wrote to memory of 5856	1776	chrome.exe	84
PID 1776 wrote to memory of 5856	1776	chrome.exe	84
PID 1776 wrote to memory of 2284	1776	chrome.exe	86
PID 1776 wrote to memory of 2284	1776	chrome.exe	86
PID 1776 wrote to memory of 1508	1776	chrome.exe	88
PID 1776 wrote to memory of 3916	1776	chrome.exe	90
PID 1776 wrote to memory of 5828	1776	chrome.exe	93
PID 1776 wrote to memory of 948	1776	chrome.exe	94
PID 1776 wrote to memory of 4108	1776	chrome.exe	95
PID 6024 wrote to memory of 748	6024	randll32.exe	96
PID 748 wrote to memory of 5264	748	csrss.exe	98
PID 748 wrote to memory of 2364	748	csrss.exe	100
PID 748 wrote to memory of 4652	748	csrss.exe	102
PID 5264 wrote to memory of 4852	5264	powershell.exe	105
PID 1776 wrote to memory of 5860	1776	chrome.exe	106

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/craftpedro62-debug/_s/raw/refs/heads/master/sass/utilities/randll32.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff834bac728,0x7ff834bac734,0x7ff834bac740
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,18126464348665533448,5509065502278209790,262144 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,16586218628464529114,5019652181749612830,524288 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,10761627568250196547,299619944916998704,524288 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2492 /prefetch:13
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,4137839499981523482,6909500364839642439,2097152 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2792 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,2838292296460434420,9955382803982230543,2097152 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,10904702406525938541,3427092048147467665,2097152 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,9559272481482697921,17149602651757653886,524288 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,14353706874109367317,12686709240434420246,524288 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,9246636308510159434,15880754215537300149,524288 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,67544810071882232,12029830159666979717,524288 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,4544145519832577377,17579989450906787785,524288 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4796,i,2523480249447088477,10432466851851969274,262144 --field-trial-handle=1916,i,7695730894722160139,16009776834248807889,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4756 /prefetch:10
  2⤵
  PID:5860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4020

C:\Users\Admin\Downloads\randll32.exe
"C:\Users\Admin\Downloads\randll32.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Users\Admin\AppData\Local\Packages\csrss.exe
  C:\Users\Admin\AppData\Local\Packages\csrss.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\SysWOW64\ReAgentc.exe
      "C:\Windows\system32\ReAgentc.exe" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Program Files\Google\Chrome\Application\csrss.exe
    "C:\Program Files\Google\Chrome\Application\csrss.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4652

C:\Users\Admin\Downloads\randll32.exe
"C:\Users\Admin\Downloads\randll32.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b7beb51aa14fc20e6f4cc6149d4682f2e9eee6b6b20d182002ac276e2eabee4f
MD5 08a35c5981ae4ea4f4c996349faa939e
SHA1 8469a4e19f04cb7ebfbf14324bf15be55556b835
SHA512 9035628bfb4bfc6b70a8bacff47a899460fed1c0ba9a109795191f1c3643484e50b1d7fc8b00d7381b7f39a21b12c2d8013e1e6cc731631b2af0d126a6a4c11f
TLSH
T15BE02BE6D827EC3B0CFE071994904742EB5513572740851F7A3D820D8FB163E0185C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 7c8a1494f30d0bc40feebd44459c1806d7b82816732beeddde5519961ebf3985
MD5 4c5bbe9887f51693f1ed5f3e11bf81c0
SHA1 d856a0a3e82fa12ae3bb5054901a2564bfec603e
SHA512 51351245189471bdafec425f8d8c68349ee253c2b2d805d9fa22dea799fc83ed4519e9f8171ace42073865106447e1edeea3bcc338a0ee13f3e6d96e663a1502
SSDEEP 24:TL/91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5H7fqrmcKdVINBpj:Tb9aw/aHLopFMavU1iBwHbfqrmcKcV
TLSH
T1EE923F8F0F303214C0F49772E9C119962E7C222CA3236A9AEE2444B39D865ABB6055E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ef8f578caf13ad9ea43345d284ef0f6eb1ce8d57b6143c0db0fa52fbd4751ae7
MD5 742b6c9108301d02f12838978790dc89
SHA1 e41eb868b8b34f6ff3884f81eeaaedcaed2dfeed
SHA512 26dc7d963a2ce5b0ca02c9e0d04e92a77b4394e04c369fe91161e8f5a5f06291dfd6d005095517742a1f78e65f8e1385fb739c2282c02c98e05d5987b08bda0c
TLSH
T1BC51ACF793B0997E861196F4DA14AE2FCE6D0524131C7CA589D4AE1B43F2973D20178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bac90d73814197e799776c1c1b6de2ffb5ed28ff1030b2903b3156d3aa53a280
MD5 30ca0bdf2272322c1006f5c6603dd69c
SHA1 794075b0f36eae19fc1529e51b01558ea254c20e
SHA512 e25050c1cfa4b19a43129f2933fc3c16708d0a3d979a0edaf97285157b576b9ff3d72d6faa7e4cc3ba000f337c43704da2ddbce0d387f223ef12b6bc5cbb07c0
SSDEEP 192:zR5e8kdmhv7+FpAPRp239hHsb+WNnl5PHkW5Wl/ej9GD2NAxfUaTVyIsnAUge:zR5ewx6FUXQbwjPEW5Wla9GD2NANUa1e
TLSH
T16242D82EF914797B5CDAD229FE517717E7F9102130902E88EAFC8A6C15E76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 89eb248497ca1741fcda73f58cfc444313d385b3a8af5fc93dfac5c8ebb69a61
MD5 212cda079aa5c0b18fad9cb16eca0687
SHA1 90618b4f8968e94364d693776f277e0225e15044
SHA512 408982a4ea211cf5d28cc2b47a9a3ba140c8656e64e24c398fa3cc528dd20ce666caec0421955992f61ef6c72a261624dea0ebd8529cd8d03a2cd8a3a4bb35c4
SSDEEP 192:zR5e8kdmRv7+FpAPRp239hHsb+WNnl5PHkW5Wl/ej9GD2NAxfUaTVyIsnAUge:zR5ewB6FUXQbwjPEW5Wla9GD2NANUa1e
TLSH
T13942D82EF914797B5CDAD229FE517717E7F9102130902E88EAFC8A6C15E76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0c2ac13ee410e0049f0427a8e913cc2598e6c1596667748abff750196c202fdf
MD5 694ec4db7979d8069158c2f21fd4b97b
SHA1 d03aa5ffc541a4657a374ef8d26782ec4275a9f0
SHA512 b65dc17c3b5b91864fb7f6b32a87cde5aeb0825992f11b98eec9b1b16ab716b0a4fee89db134dd7d0ab20fe73ec05a4c2a6eee421a3d0ff0720c80cb1b9ed1d1
TLSH
T12BB0125280435911C44382B15192048C3264AF108B061301A3E4A971D8362E18014160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586fcc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586fcc.TMP
Size 96B
SHA256 f24c57beb7a5e423b5299d249b65ba32332709a43e0dcfd1cdeb91e35ae629b6
MD5 c0e3048afe71c0db67ca1f9aa8b8a737
SHA1 32f5bfc1c4c5fead5c43189a3143764ac9fc55fd
SHA512 7b3a2d9f25854f524e6b34688b27d25c194dd41a3e716794ef4cc9e5a060240c5a113ee1ee336ebadbd55d0b25e52bf5892619f42e783c3f2e5635a9ade8271c
TLSH
T14EB02202C0032302E20203B020C2A0CC3020CF32C203220283F02EB2CC20BB00220230
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 810bf1d34df700309d3706c5a009b448cf0a3e8c777c5412c00c75c18b54f596
MD5 9a59fe6827612ce1a3e27fec355c7403
SHA1 8dd509e86bc27204ee1b16d39c90632f4daf2e67
SHA512 5fdc0477a9a0d7414cf5949100f0112cc17bc18da8d7c7ef6668827b62afc2e6c63af77456f9c1aca2ee801344d30f2235ece375bc225a7ab8dd426042667a16
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O5xeVumfnKa:1nbZeMrv/hGt5xOnKa
TLSH
T1A2D3774B3A743002EDE59A722CF054BB5D3C716D8F51A5D428B620688EF2963A63D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 3f4d7cd17810a5b707d87cdc9833339c3d115d99872e6f771b19a6b5f1e1f651
MD5 0639a3bae9a9dfabcc4220ec5aa3ece7
SHA1 88f7ba9bdbcf5dcb91091c5d52784b1c56dc7d75
SHA512 e1d82a594ef47d078d1770ab8a798aee4bb36793ff42130d176c471a169f24e5675bbfd29ed97109476da9d9a5a0091c8d445bc189adc366de0861c15aa29578
SSDEEP 1536:oGsJP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:ax++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1099312B9981E7D3563ABC6E6A0079CAD8CE3DCCE1514117C30C75F1E14EE392A30B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 4d9751c9123c7b3aeb4eaea73cfc265163621b197211e9dc815c128cdb4d61e2
MD5 b2b01cb53af8af24f1a950206d7fa721
SHA1 ce25409b7a573d6d556c4f4b28d8ad654aeab00d
SHA512 687f0fe725378c13f235551b1ea048ae4fc476652ab60301e84637593e2388dc6552f631823d32deb0dbb712052f031938642d813bddbab9b4279d9c5c4559ac
SSDEEP 1536:oGHEg9P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:ZEgV++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1E09312B9981E7D7963AAD6E690079CAC8CD3CCCE1518217C30C75F1E14BA393D30B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 91dc12553abe112753dc4a7f88a3410a3c90511b1635d5b00cdcf843042f8a90
MD5 64231edde17df4505ee9526d99aa2fdc
SHA1 fd1979a0a5cd45fbd0d30a85dcd0c173aa27d6fa
SHA512 f974ad60725ef612b3cddeb3cfe989233942fabd86f9ba5358101066007705a8228cd9580451a2e54816abc6596bfb697d57bcb8d98f08c671500dc31a7379c1
SSDEEP 1536:BGsJP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:Xx++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1B99312B9992E7D3563ABC6E6A0079CAD8CE3DCCE1514117C31C75F1E14EE392A30B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 10e904b30cdab3befc32ed4458b127c7fa7b11907c648ffa68c27070530a92b1
MD5 580b037f0715acbf0da832b229077b83
SHA1 ed0f8e368a75f0cd528c33f2e39a41eb3c93e089
SHA512 a3fbe5f4480b055585578750984e79b24019569c2135b2845980ff1c3ec110db09ad763f51ccd314a99c5ae1ea4d9f89d32e42dc54198a429fa91abf4855eba8
SSDEEP 1536:eGcIMP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:ni++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1F39312B9991E7D75636AC6D690079CAC8CE3DCCE1514117C30C7AB1E14BE393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ccpxwro2.db1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ccpxwro2.db1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

randll32.exe

Path C:\Users\Admin\Downloads\randll32.exe
Size 3.1MB
SHA256 cc46de968f628c28a3dbb33194cd7ad2b09cb63b1718a24738d2306da7060deb
MD5 b386cccc086b9f7476e556a8c619f33c
SHA1 8d4795339a171a244b8555b61b0c7bd2e02ee097
SHA512 f5f1679becd8694f2e61bcdd35edbc0e916fa2012db7d35ec002d68c79fca1f966c3238b3e9752239940763030d94545b1a49bab77ef07493bf4e9740e2fb05a
SSDEEP 49152:ShMy7WSTzKuOxln4/6x18H5L1+/GBUttJbX9xZJvOnIDzI3nNdA1Ttuu:EpDuxlnI6xIz+OBUttJzLZnzI341TX
TLSH
T1C4E5330B0B609E4ACBCE36354E218EE3D4E839315EAD0BB6F5D037848E175F86D960D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

randll32.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\randll32.exe:Zone.Identifier
Size 137B
SHA256 eb12aa538bcced6a88b9316b15af1d9c82d558e1bace518443a0c5d7c9745e20
MD5 3b671cd0ba635a12d3d2234b4f161600
SHA1 a93505606cf6b96406a15fa833cd07b525605848
SHA512 14d7f898485740e682d24522b9a424d82b58c8f424abcb71e5b566f53a757f2da9705c927c727dbd51678789b50f9492569deb009cea338ce6a5d27eacc0ff77
TLSH
T15AC08C82820005180F01F0C8A6A8445C90AA506648A18195B8A0C069E2C43860164F10
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-259-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-125-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-126-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-254-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-253-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-162-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-262-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-136-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-255-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/748-261-0x00000000002A0000-0x0000000000E2E000-memory.dmp

Download

memory/2364-182-0x0000000000F60000-0x0000000001AEE000-memory.dmp

Download

memory/2364-168-0x0000000000F60000-0x0000000001AEE000-memory.dmp

Download

memory/4652-193-0x00000000008D0000-0x000000000145E000-memory.dmp

Download

memory/4652-192-0x00000000008D0000-0x000000000145E000-memory.dmp

Download

memory/5264-220-0x0000000007A40000-0x0000000007AD6000-memory.dmp

Download

memory/5264-183-0x00000000062E0000-0x00000000062FE000-memory.dmp

Download

memory/5264-184-0x0000000006330000-0x000000000637C000-memory.dmp

Download

memory/5264-180-0x0000000005DC0000-0x0000000006117000-memory.dmp

Download

memory/5264-191-0x0000000006840000-0x0000000006886000-memory.dmp

Download

memory/5264-173-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Download

memory/5264-174-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/5264-172-0x00000000053B0000-0x00000000053D2000-memory.dmp

Download

memory/5264-205-0x0000000007700000-0x0000000007734000-memory.dmp

Download

memory/5264-207-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/5264-170-0x00000000053F0000-0x0000000005A1A000-memory.dmp

Download

memory/5264-208-0x00000000704F0000-0x0000000070847000-memory.dmp

Download

memory/5264-215-0x0000000007740000-0x000000000775E000-memory.dmp

Download

memory/5264-216-0x0000000007760000-0x0000000007804000-memory.dmp

Download

memory/5264-217-0x0000000007EC0000-0x000000000853A000-memory.dmp

Download

memory/5264-218-0x0000000007890000-0x00000000078AA000-memory.dmp

Download

memory/5264-219-0x00000000078E0000-0x00000000078EA000-memory.dmp

Download

memory/5264-169-0x0000000004CD0000-0x0000000004D06000-memory.dmp

Download

memory/5264-221-0x00000000078F0000-0x0000000007901000-memory.dmp

Download

memory/5264-238-0x0000000007930000-0x000000000793E000-memory.dmp

Download

memory/5264-239-0x0000000007940000-0x0000000007955000-memory.dmp

Download

memory/5264-240-0x00000000079C0000-0x00000000079DA000-memory.dmp

Download

memory/5264-241-0x00000000079A0000-0x00000000079A8000-memory.dmp

Download

memory/5264-246-0x00000000079D0000-0x00000000079F2000-memory.dmp

Download

memory/5264-247-0x0000000008AF0000-0x0000000009096000-memory.dmp

Download

memory/5264-251-0x0000000005220000-0x0000000005235000-memory.dmp

Download

memory/5264-252-0x0000000005A20000-0x0000000005A71000-memory.dmp

Download

memory/5264-250-0x0000000002860000-0x0000000002873000-memory.dmp

Download

memory/5824-161-0x00000000004C0000-0x000000000104E000-memory.dmp

Download

memory/5824-159-0x00000000004C0000-0x000000000104E000-memory.dmp

Download

memory/6024-124-0x00000000004C0000-0x000000000104E000-memory.dmp

Download

memory/6024-104-0x00000000004C0000-0x000000000104E000-memory.dmp

Download

memory/6024-87-0x00000000004C0000-0x000000000104E000-memory.dmp

Download

memory/6024-78-0x00000000004C0000-0x000000000104E000-memory.dmp

Download