b8b699930cee870c4f8a47df0789d9a1d04d031231488052e700495938e3076b

Analysis

max time kernel
20s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
Size 1.6MB
Sample261002-ng2vrsyflb
SHA256 b8b699930cee870c4f8a47df0789d9a1d04d031231488052e700495938e3076b
MD5 78385dc8560458eda982b2944c03a31c
SHA1 8850b46ff90efeab60ae80b09ce67cc4cb9af0f1
SHA512 cb42ce9512a0d41da65c59bd94fa6a6d1c9669f0cb92c66321bbcff91edce6a11ea2aa1319eb06b719e1969828ae393fe4e2fcc61cea0d68b403849b418b5ddb
SSDEEP 49152:yX+KdcdknCRDiOnlrT1fjBNtPPgjz88y+42myV1W:yX+KerNis/5dNtPIjIR+4Uc
TLSH
T1C87512587AA51DF8FDB78538C9435509E7A2BC120370EADF0B601AA64F376D06E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of MFA browser extension IDs. 3 IoCs

resource	yara_rule
behavioral2/memory/124-0-0x0000017797F60000-0x0000017798558000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/1448-42-0x0000013192D70000-0x0000013193368000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/2376-82-0x000001E14C760000-0x000001E14CD58000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs

resource	yara_rule
behavioral2/memory/124-0-0x0000017797F60000-0x0000017798558000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1448-42-0x0000013192D70000-0x0000013193368000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2376-82-0x000001E14C760000-0x000001E14CD58000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/124-0-0x0000017797F60000-0x0000017798558000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1448-42-0x0000013192D70000-0x0000013193368000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2376-82-0x000001E14C760000-0x000001E14CD58000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/124-0-0x0000017797F60000-0x0000017798558000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1448-42-0x0000013192D70000-0x0000013193368000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2376-82-0x000001E14C760000-0x000001E14CD58000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1744	powershell.exe
3732	powershell.exe
2868	powershell.exe
1792	powershell.exe
3504	powershell.exe
4500	powershell.exe
1552	powershell.exe
5628	powershell.exe
5828	powershell.exe
2332	powershell.exe
2892	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1448	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
4256	abe_host.exe
2328	abe_host.exe

Loads dropped DLL 34 IoCs

pid	Process
1336	chrome.exe
4580	chrome.exe
4524	chrome.exe
4524	chrome.exe
2804	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
1560	chrome.exe
4524	chrome.exe
1560	chrome.exe
4524	chrome.exe
1560	chrome.exe
4524	chrome.exe
1560	chrome.exe
5660	chrome.exe
4524	chrome.exe
1560	chrome.exe
5504	chrome.exe
4524	chrome.exe
1560	chrome.exe
5504	chrome.exe
4524	chrome.exe
1560	chrome.exe
5504	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2116	cmd.exe
6048	cmd.exe
2876	cmd.exe
4996	cmd.exe
1524	cmd.exe
3500	cmd.exe
1548	cmd.exe
5968	cmd.exe
5684	cmd.exe
3260	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTransferHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTransferHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTransferHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTransferHost.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2676	chrome.exe
5248	chrome.exe
4964	chrome.exe
3760	chrome.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2100	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
1744	powershell.exe
1744	powershell.exe
1744	powershell.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
4256	abe_host.exe
4256	abe_host.exe
4256	abe_host.exe
4256	abe_host.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
4256	abe_host.exe
4256	abe_host.exe
4256	abe_host.exe
4256	abe_host.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2328	abe_host.exe
2328	abe_host.exe
2328	abe_host.exe
2328	abe_host.exe
1792	powershell.exe
1792	powershell.exe
1792	powershell.exe
2328	abe_host.exe
2328	abe_host.exe
2328	abe_host.exe
2328	abe_host.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
2376	BackgroundTransferHost.exe
3504	powershell.exe
3504	powershell.exe
3504	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
1552	powershell.exe
1552	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe
Token: 36	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe
Token: 36	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 124 wrote to memory of 5428	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	90
PID 124 wrote to memory of 5088	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	92
PID 124 wrote to memory of 5028	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	94
PID 124 wrote to memory of 3012	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	96
PID 124 wrote to memory of 3616	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	98
PID 124 wrote to memory of 4992	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	100
PID 124 wrote to memory of 2100	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	102
PID 124 wrote to memory of 1744	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	105
PID 124 wrote to memory of 1216	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	107
PID 124 wrote to memory of 1448	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	109
PID 124 wrote to memory of 1336	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	113
PID 1336 wrote to memory of 4524	1336	chrome.exe	114
PID 1336 wrote to memory of 1992	1336	chrome.exe	116
PID 1336 wrote to memory of 1992	1336	chrome.exe	116
PID 1336 wrote to memory of 3760	1336	chrome.exe	161
PID 1336 wrote to memory of 3524	1336	chrome.exe	119
PID 1336 wrote to memory of 3524	1336	chrome.exe	119
PID 124 wrote to memory of 4256	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	120
PID 4256 wrote to memory of 4580	4256	abe_host.exe	121
PID 4580 wrote to memory of 1560	4580	chrome.exe	122
PID 4580 wrote to memory of 2724	4580	chrome.exe	125
PID 4580 wrote to memory of 2676	4580	chrome.exe	126
PID 4580 wrote to memory of 2724	4580	chrome.exe	125
PID 4580 wrote to memory of 788	4580	chrome.exe	127
PID 4580 wrote to memory of 788	4580	chrome.exe	127
PID 2376 wrote to memory of 2804	2376	BackgroundTransferHost.exe	129
PID 2804 wrote to memory of 5504	2804	chrome.exe	132
PID 2804 wrote to memory of 6032	2804	chrome.exe	133
PID 2804 wrote to memory of 5248	2804	chrome.exe	134
PID 2804 wrote to memory of 6032	2804	chrome.exe	133
PID 2804 wrote to memory of 4152	2804	chrome.exe	135
PID 2804 wrote to memory of 4152	2804	chrome.exe	135
PID 2376 wrote to memory of 2328	2376	BackgroundTransferHost.exe	141
PID 2328 wrote to memory of 5660	2328	abe_host.exe	142
PID 5660 wrote to memory of 2976	5660	chrome.exe	143
PID 5660 wrote to memory of 4964	5660	chrome.exe	145
PID 5660 wrote to memory of 2512	5660	chrome.exe	146
PID 5660 wrote to memory of 2512	5660	chrome.exe	146
PID 5660 wrote to memory of 3872	5660	chrome.exe	148
PID 5660 wrote to memory of 3872	5660	chrome.exe	148
PID 124 wrote to memory of 4996	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	149
PID 4996 wrote to memory of 2420	4996	cmd.exe	185
PID 124 wrote to memory of 3260	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	152
PID 3260 wrote to memory of 4080	3260	cmd.exe	154
PID 124 wrote to memory of 1792	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	156
PID 124 wrote to memory of 1524	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	162
PID 1524 wrote to memory of 4672	1524	cmd.exe	165
PID 124 wrote to memory of 2116	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	167
PID 2116 wrote to memory of 3384	2116	cmd.exe	169
PID 124 wrote to memory of 3500	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	170
PID 3500 wrote to memory of 4276	3500	cmd.exe	172
PID 124 wrote to memory of 3504	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	173
PID 124 wrote to memory of 4500	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	175
PID 124 wrote to memory of 1552	124	2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe	177

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_78385dc8560458eda982b2944c03a31c_icedid_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:124
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "MicrosoftWindowsDeliveryOptimization_bk101" /F
  2⤵
  PID:5428
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "MicrosoftWindowsDeliveryOptimization_bk101_UacOnce" /F
  2⤵
  PID:5088
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "ContEXE-Relog" /F
  2⤵
  PID:5028
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /TN "ContEXE-Relog" /F
  2⤵
  PID:3012
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "ContEXE-Relog-bk101" /F
  2⤵
  PID:3616
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /TN "ContEXE-Relog-bk101" /F
  2⤵
  PID:4992
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM BackgroundTransferHost.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& 'C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\_install_relog_task.ps1'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /TN "MicrosoftWindowsDeliveryOptimization_bk101_UacOnce" /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe\" --relog-uac-bootstrap" /SC ONLOGON /RL LIMITED
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1216
- C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe" --relog-poll
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --no-first-run about:blank
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1c8,0x1cc,0x1d0,0x164,0x1d4,0x7ffa20ecc728,0x7ffa20ecc734,0x7ffa20ecc740
    3⤵
    - Loads dropped DLL
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,12543738453938908333,2733211383476831341,262144 --field-trial-handle=1916,i,122746760535489023,3645758120521635157,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:1992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1536,i,7719251701768626265,18164665026620514212,524288 --field-trial-handle=1916,i,122746760535489023,3645758120521635157,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,189305957709784054,17945368926159745990,524288 --field-trial-handle=1916,i,122746760535489023,3645758120521635157,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
    3⤵
    PID:3524
- C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe
  "C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe" --unwrap
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --no-first-run about:blank
    3⤵
    - Loads dropped DLL
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1f4,0x1f8,0x1fc,0x1f0,0x200,0x7ffa20ecc728,0x7ffa20ecc734,0x7ffa20ecc740
      4⤵
      Loads dropped DLL
      PID:1560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,5091182444130300501,1475245199506307,262144 --field-trial-handle=1992,i,14360659902880727265,1238181521374076546,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
      4⤵
      PID:2724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1772,i,5669347466943384542,12831633409767461090,524288 --field-trial-handle=1992,i,14360659902880727265,1238181521374076546,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
      4⤵
      System Time Discovery
      PID:2676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,9539452309468970167,253136208655410532,524288 --field-trial-handle=1992,i,14360659902880727265,1238181521374076546,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
      4⤵
      PID:788
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
    3⤵
    PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
    3⤵
    PID:4080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; [System.TimeZoneInfo]::Local.DisplayName
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    PID:4672
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
    3⤵
    PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; Get-Date -Format 'M/d/yyyy h:mm:ss tt'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $list = Get-WinUserLanguageList; ($list | ForEach-Object { $_.LocalizedName }) -join "`n"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $lines = @(); $c = Get-CimInstance Win32_Processor | Select-Object -First 1; if ($c) { $lines += "Name: $($c.Name), $($c.NumberOfCores) Cores" }; Get-CimInstance Win32_VideoController | ForEach-Object { $lines += "Name: $($_.Name), $($_.AdapterRAM) bytes" }; $b = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory; if ($b) { $mb = [math]::Round($b/1MB, 2); $lines += "Name: Total of RAM, $mb MB or $b bytes" }; $lines -join "`n"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | ForEach-Object { $_.displayName } } catch { }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2332

C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --no-first-run about:blank
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1d8,0x1f4,0x1f8,0x1ac,0x1fc,0x7ffa20ecc728,0x7ffa20ecc734,0x7ffa20ecc740
    3⤵
    - Loads dropped DLL
    PID:5504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1684,i,8610828740464642756,14716389872190579863,262144 --field-trial-handle=2024,i,14655767286941521762,10050897440395350528,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:6032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,2193754298733275524,16363617500792523146,524288 --field-trial-handle=2024,i,14655767286941521762,10050897440395350528,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,8588741361846384531,713899027353301217,524288 --field-trial-handle=2024,i,14655767286941521762,10050897440395350528,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:13
    3⤵
    PID:4152
- C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe
  "C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe" --unwrap
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --no-first-run about:blank
    3⤵
    - Loads dropped DLL
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1f0,0x1f4,0x1f8,0x1b0,0x1fc,0x7ffa20ecc728,0x7ffa20ecc734,0x7ffa20ecc740
      4⤵
      PID:2976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,5007513289732016054,13210462775609938579,524288 --field-trial-handle=1976,i,2420338444491260934,18286204134839734826,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
      4⤵
      System Time Discovery
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,10213679603920115081,10707991591359113001,524288 --field-trial-handle=1976,i,2420338444491260934,18286204134839734826,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
      4⤵
      PID:2512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,5457035452103994563,939626698831812106,262144 --field-trial-handle=1976,i,2420338444491260934,18286204134839734826,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
      4⤵
      PID:3872
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
  2⤵
  - Executes a command shell one-liner
  PID:1548
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
    3⤵
    PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
  2⤵
  - Executes a command shell one-liner
  PID:6048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2420
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
    3⤵
    PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; [System.TimeZoneInfo]::Local.DisplayName
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5628
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
  2⤵
  - Executes a command shell one-liner
  PID:5684
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    PID:1380
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
  2⤵
  - Executes a command shell one-liner
  PID:2876
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    PID:1072
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
  2⤵
  - Executes a command shell one-liner
  PID:5968
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
    3⤵
    PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; Get-Date -Format 'M/d/yyyy h:mm:ss tt'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $list = Get-WinUserLanguageList; ($list | ForEach-Object { $_.LocalizedName }) -join "`n"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $lines = @(); $c = Get-CimInstance Win32_Processor | Select-Object -First 1; if ($c) { $lines += "Name: $($c.Name), $($c.NumberOfCores) Cores" }; Get-CimInstance Win32_VideoController | ForEach-Object { $lines += "Name: $($_.Name), $($_.AdapterRAM) bytes" }; $b = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory; if ($b) { $mb = [math]::Round($b/1MB, 2); $lines += "Name: Total of RAM, $mb MB or $b bytes" }; $lines -join "`n"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | ForEach-Object { $_.displayName } } catch { }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abe_host.exe

Path C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe
Size 110KB
SHA256 dcbd1ad12cd04c6f62b25ff60554687613ab06c449a38b0700477621bb91a5ca
MD5 40ad7d301c8da4dff37e8e1e50b7b1bd
SHA1 95895d214b53753a482970c4e71ce439581b1fd1
SHA512 802695b0f093b433309e4a82fd93a7c7d9a709ee128a40912f48e778413939ec4b5e733286f950793fb423aa47f6c70b6279838a7ee6c6c83d964e955f14dc90
SSDEEP 1536:9WZSSY3wj16x5ZlSCcHSOzGAkOMUmXRtS780HCO70WRdoiPXDDhIK8WISEeyk+wz:9kY3wj16tlSTy9ROMUqtStiPWboij
TLSH
T1C9B35B0BB65355ECC116C57886E79A72BEB2F82904306E3E1394DE321E11FA16F3DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc39326ff37e834f9d975f99.token

Path C:\Users\Admin\AppData\Local\ContEXE\dc39326ff37e834f9d975f99.token
Size 46B
SHA256 38ae0497922391331769f970add5c164a40e1274acc521d95d36a27ff5449608
MD5 b957e62a97ae5fde7f136e077374d39f
SHA1 f570203d2a75eab10d952b9d31c019a57e74d091
SHA512 eada057f0c282374a4544da6db446fe2583ebcae72c8f09bf2b110cc337a46018a4f30051406754866d8e20fb8e884b58d9283bb6daa43d490eac6babd3dbffd
MD5 SHA1 SHA512

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 a6dbb434f36ae55060163a7d85eee70b17587afd6b0d987ed7212ac8d225fab0
MD5 f06d9a896416632462bdcdafae407ce7
SHA1 9cd83187c6bbce894598d89694b220b664c2a518
SHA512 48a3caa9038b1df58f2a3a7652aa4d588284debf8221b92149ddb1e660112024320caaf44fec54a9db239388da2ece4e71de44dddce7fba47492c729ccecebe5
TLSH
T13D3120B6948C54B92A916F93D8E7F7B0CFFBD48CDE2161163086ACDD448405A72CB25B
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 36d3a870f6623bf1f50e08ab73d838f26da4d6cd4d781dc0c489c69b27762dab
MD5 000341f61a76ab4d0f360c69d1cf5d87
SHA1 34933ef52773ab85dfa66e236796b4b194a5f4b3
SHA512 9faa32a2f37260c5fddcdaa041d2db7f970363ae8da0f7044e09bce828cfb9f6706ba383b48b71c79436d9f3130188a700c5e07301f30b56a5f5774c24dbf977
TLSH
T1513151B7948C54B92A916F83D8E7F770CFEBD48CCE2160163086ECDD448419A72CA25B
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 eaea4d696b0b1e1bd51d3aad8b94f0877057e70ff43832a79196f45150eb04c4
MD5 0f9b342c22f547d5928b59e793a2bb2f
SHA1 090779a4cddced4b70f3b59e903db95cb9eecaa7
SHA512 3c2243b5cd381367ce6cf2b9ede8509e99b34d2d7477ec428cbfcbf79986db64386cfa45ddcf1f2a3911a935fe6dae269adea120fe30161127a77ed5c06b94a0
TLSH
T1153175A3C4C894A92B902B93C8D6F730CFFE904CDE15601630469CED44881AE73DA74F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 ec44deeffd4159b6eed61442eb2cb6419306f8d5c7ac1ba9d8e05da5be0c79a5
MD5 bfc541b9a79db05fbbb983143cd7e45f
SHA1 ac0373a66fcb71d16039d978c8c700d6e0d98f2b
SHA512 4aabad40aae913b5831c1ee5041f79e64bf13699ef8b07c0a7e024e09d543aef725d7b6d7646d770690c56eedc8cefd1d8ee36322b0303661fc48c89ce24e987
TLSH
T1944153A3C48894A967906A93D4D6FB30CFFED05CDA15601730869CAD44881AE73DA79F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 2KB
SHA256 a0e9d39762e7a4da1b7e3b55a0651460d877042bad99da92bab73b8a7572e4c6
MD5 2f6651497e3e1d0c8ea7df52b069aa7f
SHA1 b37b33af04fd911f1769201a51b4493bf27623df
SHA512 f86314f7cf47d2642945106cee28e834a87be3d9c12e00c3f8e4889384c9c8caf30a8b593606e02cbc04fd32b4ac9053571d8408e41a7d95bfe707589db84528
TLSH
T19A4174A7C48494A967906A83C896FB70CFFED05CDA25611730858CED04885AEB3C974B
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 2KB
SHA256 ce7f995b834b5b4e6c25d993725549da35a437bf651f7060958857c48211384c
MD5 9da541ab864ab8e104f626467e4db7e7
SHA1 606d5256f5364602a14ec2e85110114a592a0310
SHA512 955b11aed726846c79bd61e8ba7318c1978e3e07c0ce5c2ef1947eb5cae38cdb959a4cf35aff2a3ba6e56c63498140e39a00f8419b5173026c5d7c4d3e2b66c1
TLSH
T14B518697C884D4A967C05A83D896FA70CFFA901CDA29611B3085DCFD048859DB3CD74F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 2KB
SHA256 c0c7349612ffe0d1864f330eab2f9bab3f219e8aed0cab2199e346b61bb841a8
MD5 c88790b284cd84cc197f5cac2455f5d0
SHA1 6b5974f512bb5559b69482cb877519cb147523ed
SHA512 fed58ea13ba58d3df1cc844aba2e6c6ab761cf700f65b599faac7b9e627f4db2047c446d7dfef6ed14ad4a6c1c52de2f36a3f9fc04852570c8371d9143e1d838
TLSH
T10E516597C844D4AD67D09A83D896FE70CFFE901CD9296127308588ED448855EB3CD79F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 2KB
SHA256 48249a3c3f82f63360cbe6f4a8b3086ee4c09799d252c83a5cafc4d104c9fcf8
MD5 d07f8dcf892cd870985191ee6175b91c
SHA1 ac1337418636d86331795541c25efbeda2f9e86d
SHA512 51ba4013e96511426bd554474f037b4f552bc1dbf8c61b0aa8e0c92d29e01c996e596c5e727d87c9e51305b3f11e3b2c26af368c5bc2223eb010d4ad14018043
TLSH
T118516497C844D4A967D09A83D896FE70CFFE901CD92961273085C8ED448859EB3CD79F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 3KB
SHA256 6b4783cadf8c5e4dcc8f13e134fe9b3acd30a0d3583c9a34675cb96aaaf5437e
MD5 742d82b17d9283b0a3b65887bec02251
SHA1 00a564652dc87bb4b0e59f4b1657c8a08847570b
SHA512 b47e1ef67cb6b655df14a00ca5e25c03b3cd4a36e632d2a2ce01ec7fa614aaad3dc0f6760fb332eac29ea67453b438d14e84af4a19014dd869a42e02d608c33f
TLSH
T11571424798C5C56D53C09AD2D8A1FB68CEFEA018D66931273A42C8EC458855DF3CD78E
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 4KB
SHA256 60cdf70610e5144d59167221c39b005c70c256eb37ede9eb714e9dd929b60c82
MD5 1d4f35da0ec1234f74c661508980b9e8
SHA1 e827a570b82f764e653c548dad78af68f248d0d6
SHA512 72f73f77d7f83d101d18fe228c0bb68c4c5b15224912b5111d71d98be2cec47771844266eee96c3522fa807d09fc08a709358bde763dd695bd061a8de054a9b7
SSDEEP 96:/arbmn5amhiw1/4//+5DTZFw1/vbvVT/iT/mT/OT/O3:/aI1iw1c0ZFw1bvVGKy63
TLSH
T17D9132479C85C46D67C099D2D461FF18CAFEB028D6AD252A3A42D8EC458855DF3CC78F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 14a12505400eea6c2214d6d5892bf0a67fa6f86151008efa35ff8a6b582a4d4b
MD5 38a98a8710c7b782f2d9cb93d89da219
SHA1 7873eb1950b05f83f99328b02d7da8807804fdd9
SHA512 aa00d9629c9a95d0f4c025c8fb75b30ec024d5c8c7480a8135d5f14b97b04dbe2ec41bf5700d909a581250e5855088924736829f15b7921dd911873efcca2b15
TLSH
T10E2144B5D58C50F529812F53D8DBE3B0DFFAD44CDF21A11A3186ECDD084408A62D765B
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 8ad1b16d722ade1413dac9c7c8fd05878cde8332019c85edd1525f540e64c170
MD5 ec4d222d1d7da6c4dd56c3e66834c4bc
SHA1 e39567cd0974cedfff38d41beef580aba1252dba
SHA512 9ded9979e8351bc8f6e37778848293d1aef4401784b1d46126134ff4e55e49aae73defd6e2d07fef17c530a7a15989abfce2b39c417dc04c3d1840a41fcd0a45
TLSH
T1752130B5D58C50F529812F93D8DBE3B0DFFAD88CDF21A11A209AECDD088448923D365B
MD5 SHA1 SHA512 TLSH

Submit Download

252de749-5ef8-4572-8871-4b4ba21de5ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\252de749-5ef8-4572-8871-4b4ba21de5ed.tmp
Size 5KB
SHA256 e504473e8c4848a2fab37c62b6bbe1779317219d0593689262d3ad46a0bbd97f
MD5 9bd5332b673aef45cedb0b435c4a7ce0
SHA1 e3f1e8d69a54fd26712280655d34680a9d6caded
SHA512 d00571edae4329cc6bfab2c07feb59c9a4abcc911997af5867e4be5959bcfcbababe6d6d20ce49d00cd98e6769d4d576afd4bb189ed876a3d09aecc98a568582
SSDEEP 96:fC0d+7N0X7jVYVfGTV2sESl8h4otok5yJcDlB68GyvoD3EFH0p1QzbpXKZS3OH9z:fC0ESKk+iUDMKbsp4FH0c93OH9Us
TLSH
T1C0C1E975A46DBC7755F6A5A1B0033A47CEB4216FD940AEA4EADE0F0C15E70DC2342526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d5015b6-b0eb-40ae-ac22-a504e42fb430.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2d5015b6-b0eb-40ae-ac22-a504e42fb430.tmp
Size 5KB
SHA256 a65c5fa9a90d047fac79807ad101b595f9405bd4b39694c0ab3feb81581d6214
MD5 ced42cbf584dfba993ef703870439c1f
SHA1 84da0cfc9214df28b37ecee251cf3374e69a50a9
SHA512 173e033af35769b0df09b68f48afb8592dccb33ac787323315bffc3973c06f1014896b63a484719b55f8b512308df6f543fa78e49437ead78bcbbae1b9e3982b
SSDEEP 96:fC0d+7N0X7jVYVfGTV2sESl8h4otok5yNDlB68GyvoD3EFH0p1QzbpXKZSGv/391:fC0ESKk+iUDSbsp4FH0c9Gvv9Uq
TLSH
T1F6C1E875A86DBC7759F6E5A2A4033A43CEB4216BE540AEA4EADE0F0C15D70EC2342526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

722ca3cd-2ea5-4591-b3e4-904659ce8943.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\722ca3cd-2ea5-4591-b3e4-904659ce8943.tmp
Size 5KB
SHA256 8da0bd19a17f42e9916c4c607c03567a7dca9636dc321d80d78625a0b2c67dc5
MD5 23cfdde5b938a31034fa6b19af653cee
SHA1 5eaaaac5c86a7d92c31f80bdb1c7726e3756c606
SHA512 ebf2c4b1ddb4b1e31e46568e47f73cee9aa37eac8ca040f4e2bb04555b9d100a1ffdf05b5303e8b9d525dc10f1257e0ef145d6c9d26baf57483466806e2a0162
SSDEEP 96:fC0d+7N0X7jVYVfGTV2sESl8h4otok5yHDlB68GyvoD3EFH0p1QzbpXKZSF0i90O:fC0ESKk+iUDMbsp4FH0c9F0i9UA
TLSH
T151C1F975B86DAC7759FBE5A6B0033A43CEB4217BD540AEA4EADE0F0C15D70DC2342526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 95156e85b10bb169669ac3a8fd229cfc0fca67c83c351ee5fb76ca8d89d5e1be
MD5 0e3d1285ddae06a225fe04ae6af82b07
SHA1 8b978c7f8232dd442e11dfffef2c83ca59b28c38
SHA512 80afb4af262e2c48dbaf6a132572df5f508b1bc75b767aa0e1c3120174946162fe57cb5e4d27adf119ed9d8b08b5a29cfdf85d6351217ffc2219bdda998e30cf
MD5 SHA1 SHA512

Submit Download

26795aa2-39fd-4fc1-9670-92d15b16a39c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\26795aa2-39fd-4fc1-9670-92d15b16a39c.tmp
Size 11KB
SHA256 4e6c490de08d18d119a36d022b04ea6edb18ea6dbca11b046ee3b6ecb9a67625
MD5 e2537e5a5003e698e025f5c391950f05
SHA1 f7cc9c27ae92f955ec25179b75a378e8bca060f5
SHA512 ab1425b4f0375174b6ca27624c90462f6eb2187f981633ab7a7ec0dd029fb931348ea8eb4317c89b309c0f2ba8d53d9010404994bf99cbbb61c74b8d65545459
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9a7v+ANAPH:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFY
TLSH
T16832D917A84D6E7F0FD8D50DCC166F4B6DB5029676680D2893FBAD0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d0bce42-2714-4f65-a234-4032b9c0353b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5d0bce42-2714-4f65-a234-4032b9c0353b.tmp
Size 10KB
SHA256 6f093ca66577e2e0f18f64266d067766003fb520c127a3602de8dcbaf9b1d0aa
MD5 fc6f765b0afd0fcc2d3869cf2d064a31
SHA1 687a7ee5665312e3afc12fbc1072e5d47c6899fd
SHA512 82f4a09f739ef7496dc46d0618d43a913fd6dcd097c00e7508f1d7c7d8dd79f4d31a6a40e50735c98f647f02c23225ad21e6284218369781a75a530a1b0dca7b
SSDEEP 192:RRWn/DyH7Bv7YvAPRp2s9xHsb+WNnxO2hdxyIsnAUgR:RRWn/2Rk6XrDwY2JR
TLSH
T14922721EAE64797F5DDAD21EFA217B53E6F5202134E12E84EAF8893C21E75CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 b15dfef87c5173eb62be2bd450d4daf88348131809edee7b863b02d3b639da8b
MD5 decec07d1c4bf829ebb0684af87b00cd
SHA1 8fe22211946b6769dc550c9e04baa0363f08b1a1
SHA512 bef34a20aa8ffdd6b9da90e71cfdb0aa6a5745ca4978b114b35e2fa882fcb1faf00634c8e55c5d795f08e4b07b5060d09f3ae8cb013004d53d9740c025b8e701
TLSH
T1D4E086D4649DD53D61A894A782F4730E8FD0B805A6D8384657CDECD02195A0566A9760
MD5 SHA1 SHA512 TLSH

Submit Download

016510ee-b68c-4886-be8e-7ce7e9a06a31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\016510ee-b68c-4886-be8e-7ce7e9a06a31.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

20aa4429-ace3-4890-9a95-69642d7a526c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\20aa4429-ace3-4890-9a95-69642d7a526c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 7c677676e7d916839b6b8340b712aa73643fefe7737503f92c79d338db850b17
MD5 09818789bf7d896448da1947041f1be6
SHA1 47a98c4eac5f351b835afbf1d73b45ad331d8103
SHA512 8cd1a642bbd2d87932b2e39f1a48b8162b2a938167b49c6ec43cd232c013973e5beabf7512b33c0ba1ed8aeb5c5eac1480b5ae4d85f090b8cbfd494dd8c7ba5c
TLSH
T120E026F035C9D53E20EB801B02B0B30E9FE4F41AD3D838466FC8E64015C980870E5671
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 5eb8ce924493200d44105ab24ccd8d0bbeed995b4f3748bf14be7161fcec3197
MD5 3f15a305c70994b90c4839af6f684370
SHA1 d60ddd0db474548228548a78a0d3f00938969c1e
SHA512 690755d36ccbaa18483d42ef4dc87dcc260ed2d6086c98669071de9d1ec7f6ca28ef0cf42b912cdad3cae31a4d6d20ab01d034555f96abf84b883bce9b1cb222
TLSH
T157E0D8B02ACADA7E7199505B1260F30D8EE1F401D6E916566F89F240528A844B1A5650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 65e69fe12ab326dfb2d6893979965a9e8c004aeabc81289a353ed9c04393972b
MD5 7958aca3ee10c54a597ead78830dfad5
SHA1 2c1ccaea3bffbb6b64d6a02aada4076a1ce0deff
SHA512 f178ae09e84f64d383eaf037a078a0d5aed4d3f71de2271ff0084c1b23cd67650b6f0b84d88d2ddd95586feba83b2fd9151e93951a974418dbe3593008b8677c
TLSH
T1C0E086F465D9DA3D2198C05742B0B34E8FF0F805D7E5758A978CE5446B8550871F8AA0
MD5 SHA1 SHA512 TLSH

Submit Download

a2510eda-7e6a-4f5a-8362-854b9b9a4adc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a2510eda-7e6a-4f5a-8362-854b9b9a4adc.tmp
Size 10KB
SHA256 58dc599168620e3a85b717d0a43fdc492df00a1338a5c0d0d1f437328baab2be
MD5 11b7bdacf5aaeb79eb26757e66017fd9
SHA1 87a73dc8b1c076fff3f2a48544ec008e3caeee16
SHA512 b23d7e340d317234a1075d5637faf5e7f2bbb20334cd9871c3ac1ad67ec6e4474a7d4b23bb58095acd913d2eec7f16c60236e4bff32954ad2863a4c5e2339c37
SSDEEP 192:RRWnskDyH7Bv7YvAPRp2s9xHsb+WNnxO2hLBtxyIsnAUgR:RRWnn2Rk6XrDwY2pBfR
TLSH
T11322611EAD64757F5DDAD21EFA227B53E6F5202234E12E88E6F8893C21E75CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 774B
SHA256 4406390f2c70bebeccbdb1cbdf85b3572510b1d32b76a1ac912dd23847e86ba5
MD5 96538395029f8d451f3ac7c5f68b5892
SHA1 b9cbac61b069872f22a99b7ae1166df0bbf01d4d
SHA512 e916af8ec78ef3fe4d0dbdea6630fae83ed47c27aafefc8423cf674177a560c0590a08abd3b8402a22ab52cb06fcd839db5fa4c3af79d8bda409823946cd1db3
TLSH
T11301BE05F330C100D18A867A687BAB251734D8A29FB8FC0F447564283E76A501E8B3E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 10f0e65bf89b626898017287d4cd2bcb2391816ca021f45a4ba94810bafbde31
MD5 1258ee6e3b98da338596e6784ac92ea8
SHA1 99cfd6623ae4779e5fba9f6281c1eef81b939f1b
SHA512 a54c0342433450691a3a7b749b1a59e005fb8d3c9675a708ce71abd9fa4c99c8fc5a024c5ccce74aad5374985bcfe9d7a80fc497e653628dcb6f22971bfbf397
TLSH
T19EE020D0B48CC55F506440AB41B1B34D9FD07801EAF41D454FC4DD845A845047A99551
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7790a5698efcb49a66a9f5d00f7484452435b983b5613a26d322d2075b6ed7e8
MD5 eb624b48045d96b1d3f0202761d492c0
SHA1 0f80197a415dc99e6b03a41d887fe82a55e586e0
SHA512 f690081e63152ea9ab4c8d58be1339631bc7673ed52a413a1f71c384f9ace66ebcbff508f0e2e7713a15cb039e0c57b61a312f944236e0976dcf36bc3ad89dbe
SSDEEP 96:fC0d+7N0X7jVYVfGTV2sESl8h4otok5y6DlB68GyvoD3EFH0p1QzbpXKZSIBK90N:fC0ESKk+iUDfbsp4FH0c9IBK9Ur
TLSH
T185C1F875B87DBC7759F6A5A2B0033A43CEB4216BE540AEA4EADF0F1C15D70EC2342526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 40395d9ca4b65d48deac792844a77d4f8051f1cef30df561dacfeeed3c3bae13
MD5 8549c255650427d618ef18b14dfd2b56
SHA1 8272585186777b344db3960df62b00f570d247f6
SHA512 e5bb8a0ad338372635c3629e306604e3dc5a5c26fb5547a3dd7e404e5261630612c07326e7ebf5b47abafade8e555965a1a59a1eecfc496dcdd5003048898a8c
TLSH
T1DEA0120384738406E4184092C45C1341287C80570119C0012074931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

b5e7c1e0-1b0c-4fa7-ba0b-e226cfafd5e9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b5e7c1e0-1b0c-4fa7-ba0b-e226cfafd5e9.tmp
Size 4KB
SHA256 c5e44752820979011b9adca2bd4950ebd93cf70fe7f9636d074c99f2f41cb902
MD5 3f9314ec078287a0110664b0b250baff
SHA1 53f8c6c15efd6c57f274d0b0c95e2b16d8c383da
SHA512 1bace535c2a3f4a00a422f20aab9956c15ae192a010763778e46b55ea60ddc4831a8f35a59fe032d0c06fc4e28859866b834f88202c0a4f7e588432865f7a827
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5yhDlB6FGyvoD3Emwr+Tbv4v4a:fC0ESKkdDUDqbBp4mwr+Tbvi
TLSH
T19BA1F831A8689C7B55FAD849B4423A43CEB4317BD461AE94E9DD4F0814E70EC1341567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTransferHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe
Size 1.6MB
SHA256 b8b699930cee870c4f8a47df0789d9a1d04d031231488052e700495938e3076b
MD5 78385dc8560458eda982b2944c03a31c
SHA1 8850b46ff90efeab60ae80b09ce67cc4cb9af0f1
SHA512 cb42ce9512a0d41da65c59bd94fa6a6d1c9669f0cb92c66321bbcff91edce6a11ea2aa1319eb06b719e1969828ae393fe4e2fcc61cea0d68b403849b418b5ddb
SSDEEP 49152:yX+KdcdknCRDiOnlrT1fjBNtPPgjz88y+42myV1W:yX+KerNis/5dNtPIjIR+4Uc
TLSH
T1C87512587AA51DF8FDB78538C9435509E7A2BC120370EADF0B601AA64F376D06E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_install_relog_task.ps1

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\_install_relog_task.ps1
Size 1KB
SHA256 1661f39f19b2c3599a6639af893eeee5b3ceda8c2c0bab06ff60a325a2f8057f
MD5 ab72fdeb8bdac7d421254cf0c7fc67a2
SHA1 6d81d28d2c6e4d1eb36b84215448151d09a5ff2f
SHA512 416cb54f86920b3e1b9bbc5163596a50e2c6e4ff570c6bc28cb1a75cd654d1f8054540219eb6d50bda772d7963831cddf7df5f3c296cc073dd2093bf0126323b
TLSH
T1B121AC35B60870AFE6232A3AC2C7D7E63EBD1079403386098955D019A2D64AFD71682B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_01herqsz.hbr.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_01herqsz.hbr.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ContEXE_abe.dll

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\ContEXE_abe.dll
Size 44KB
SHA256 c190fbb3791c55ade7d4d74fb470d687ba92bf611107df8c922119619fd50df5
MD5 33101ff793ce4d726e3337dc5b8de8c8
SHA1 f650da4260d7fa85d847bc88678122d643e43745
SHA512 3df545cd2b5a9de1c7c55e59e5d76a64a71edc0e05bff326b48849264739f98ead12e3b41e67781fca4ee72ef9b766c3d592fcd259be0fb3c1d996df19b74ee1
SSDEEP 768:Lc+JVxAwA6vutUvv1LtS78kHHCezlMU8+guydMOXGRdcoQj0FnFhL:imXRtS780HCO70WRdoiP
TLSH
T173136C0F76A3A5FDC506C53892E78670B871F83914306D3F2399EB771E26E112B2E619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cipher.bin

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\cipher.bin
Size 640B
SHA256 40cd3197d1323d6bd0710c94bf0b4f80d1d9497cd3aa4c9098f4d01c96397907
MD5 a925844f0a6d56e9cbac02ffa01b9105
SHA1 8125a5c2e35efaa863685586a16998b06109a49b
SHA512 8e94f015f07d7b4b2725d0f6d37b6c4a882ca988ed21323e2f77e8c275654eb5948e48c0c601a32bb5fe76ba06848972d454ecb9d16635022b6fd5158f8b0f0e
TLSH
T174F0B72213138C8CD400B33CF1DE9BA92797DDB2B63A1B29280535B94C3D9848E39F5A
MD5 SHA1 SHA512 TLSH

Submit Download

config.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\config.txt
Size 80B
SHA256 b1bf64b7b90a76efa4325f4723ce5dae716d1a3768350d442f45cc524f4e220b
MD5 193d20b052207b54fc623beee96623f4
SHA1 2f594b0304954b22fe2007bf38daff6046f923e1
SHA512 8f6d11cef0e9d92719e426149deffc3364d46a56d67c178bb86a99b665ccbc434403f7683c4a943de5162bcf03e7c9476f137922d6d1f4e3a368d835799d3dc8
TLSH
T15FA01188BA38238AA00030882CAC0200080802AA28BAA0C20A082AAAEE000022A308A0
MD5 SHA1 SHA512 TLSH

Submit Download

config.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\config.txt
Size 80B
SHA256 b28401d5e62e7951e1a3617094edbc1d01ecc4fe9fe912281ccb365bc40e7c12
MD5 41efc48b9aadf5f3e1bb8cb43e830f3a
SHA1 dce9d28bd913a1758911c3e62f6969c81642443b
SHA512 757bdd3f922e2c1d15290a4dcc11178077119382f01431942b1adaa519e4011d7c0a05105712472f1e3ccd71cc6cf975b967bb4cb2fb20dc67e2eabff89e07e2
TLSH
T1F7A01188BA38038AA00030882CAC0200080802AA28BAA0C20A082AAAEE000022A308A0
MD5 SHA1 SHA512 TLSH

Submit Download

config.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\config.txt
Size 80B
SHA256 e994a53449da88941592089c155f5586fcb7ef489f9721b71d2a1f2486ab7826
MD5 97b39e5ebf9cd59fe80b157e2ef47074
SHA1 b352d99b4bffa1d8453c5850a2a44ed24a286742
SHA512 3eb81aa50b9bc91814fd7975d8a012cc322a4bdd67528a9cf38eb89594a376857b2af7c1fdcebc9e1838beadd0fed7cdf3246cd390c6b6d70a5433f283b74ff5
TLSH
T14DA02280F308A3AC8803020E2C288A008800000C0C3C3CCC8B38A0FFCA0CC0802E3EFB
MD5 SHA1 SHA512 TLSH

Submit Download

config.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\config.txt
Size 80B
SHA256 2e784895da06793a5047cd23c49d413c7cfb0c7eaabaee56d03608a34b7c1c2a
MD5 18c6db0413e0fe9b02b596e6c5a4c4fc
SHA1 9967dc892c7d686e240ab908f3a464f6da8eba6b
SHA512 f9aecfb13814cbb69c94c88256143d748b9856e70bd5f08e9cad290f6a6056ecc15df9026fcddf184be25cff3338d65a69b81308ae405844c3db512fb1c3ef1b
TLSH
T14AA0124131401764010101C51D2C05170A54028D463C94A00018B4AFBD100041261890
MD5 SHA1 SHA512 TLSH

Submit Download

done.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\done.txt
Size 21B
SHA256 ec03a5dccc54b25832f5c6928dd62a73d7db4a45c63b8928bf9df672cb955c65
MD5 afd6878f65314e2bece9db10858c784a
SHA1 6956c5377a4386bc89f6e163173acdc79857b6f3
SHA512 6e62623ae743de19366c08e59bc88f4eaac7342425e5a28a2d2e63daeca8969e4e26c13d7d610cd2d493d2d80b783033bce1e463552db52e3295f6a14f75a1d1
MD5 SHA1 SHA512

Submit Download

done.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\done.txt
Size 11B
SHA256 393f59d1dcb524d6c1d9f03bc60e9836dfd21b2b856f2892bb61714c8aaee994
MD5 0d17c444cb370142a149b5736aa8eaab
SHA1 5bb9c0be06a5dc758e594c50bf33ca1ef2e6ad27
SHA512 3e62baa486f1ed9c55d724bdd025bc9a5e3d339cd961ae5dc5ad97a4fb3b32cfb78299e790a89de2de6924ae2b77af0fd40a7a7d7372efcb1eadddf64175b7e2
MD5 SHA1 SHA512

Submit Download

done.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\done.txt
Size 2B
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
MD5 444bcb3a3fcf8389296c49467f27e1d6
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
MD5 SHA1 SHA512

Submit Download

host_unwrap.bin

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\host_unwrap.bin
Size 661B
SHA256 714227c9a3385716f5be0acf4e907958a03db0ef5fc2efc9acc10d29f4b4816d
MD5 a098c294042450b810335bd46a77e698
SHA1 e72939a95be996ba017f08ce4f30efdd31178ad0
SHA512 6ac6d995c5ff85f3c4ae59067a84108ab6b01bc87f3d8a108507dae441049182d4020038d37d3cf4351045adc8871aba44a814450f4624c5df1629edc762bda4
TLSH
T19F01681113138C8CD400B33CF1DB97991AD6DDB2B62E1729241535794C295448D79F59
MD5 SHA1 SHA512 TLSH

Submit Download

out.bin

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\out.bin
Size 32B
SHA256 6caa4fa779d8101a182b913af3f963f8a090b3844825442d1d7118da986ef1c3
MD5 0f05dcc5e73a97e83eb0491c681980fd
SHA1 ab602a0103c1d7318e2eb3f0aa6c8e34f465ba81
SHA512 e59696cd1762fc3c84e282b793e041411613faa8472720b488522728dc3f91adb2d0ee1025456d78ed2e908d13eb8199cc72a6d0d030918db612824654535fdb
MD5 SHA1 SHA512

Submit Download

memory/124-0-0x0000017797F60000-0x0000017798558000-memory.dmp

Download

memory/1448-42-0x0000013192D70000-0x0000013193368000-memory.dmp

Download

memory/1744-27-0x000001C2DDAA0000-0x000001C2DDB52000-memory.dmp

Download

memory/1744-28-0x000001C2C5850000-0x000001C2C585A000-memory.dmp

Download

memory/1744-29-0x000001C2DD940000-0x000001C2DD95E000-memory.dmp

Download

memory/1744-26-0x000001C2DD900000-0x000001C2DD91E000-memory.dmp

Download

memory/1744-22-0x000001C2C5870000-0x000001C2C5892000-memory.dmp

Download

memory/2328-527-0x00007FF680C10000-0x00007FF680C34000-memory.dmp

Download

memory/2332-582-0x000002AEBA450000-0x000002AEBA502000-memory.dmp

Download

memory/2332-585-0x000002AEBA1D0000-0x000002AEBA1F4000-memory.dmp

Download

memory/2332-584-0x000002AEBA1D0000-0x000002AEBA1FA000-memory.dmp

Download

memory/2376-82-0x000001E14C760000-0x000001E14CD58000-memory.dmp

Download

memory/4256-297-0x00007FF740690000-0x00007FF7406B4000-memory.dmp

Download