263272acfcbea8dbff33b10482e86b831f5508ccd533d8230b0a82722fb8ec11

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
Size 1.6MB
Sample261002-w4yevsfg39
SHA256 263272acfcbea8dbff33b10482e86b831f5508ccd533d8230b0a82722fb8ec11
MD5 2155786abe10bf9a5c5f3c4cd0f1d2a7
SHA1 fa2dd0802acd3c04259e72408b79ba1787526a46
SHA512 b2fc5365756eb0ff83414a6d234f8ae77195b775455a6b1614a13033d6f31c7e170069c5814bd4a6de9dc5e446d23299d2d5a65f321f6f9aea73b8ffdf5296b1
SSDEEP 49152:CX+KdcKnNBXFc1UEJvIZfliWwAucLsai0boe:CX+KdnNByUwIgAYai0j
TLSH
T127751255B3965CF9E8B7C0389D828506DA727C525BB1EACF0B604AD79F231D08D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of MFA browser extension IDs. 3 IoCs

resource	yara_rule
behavioral2/memory/4912-0-0x0000024ACBE00000-0x0000024ACC3F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/1440-42-0x000001F7B8420000-0x000001F7B8A18000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs
behavioral2/memory/5816-46-0x0000019B67960000-0x0000019B67F58000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs

resource	yara_rule
behavioral2/memory/4912-0-0x0000024ACBE00000-0x0000024ACC3F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1440-42-0x000001F7B8420000-0x000001F7B8A18000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5816-46-0x0000019B67960000-0x0000019B67F58000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/4912-0-0x0000024ACBE00000-0x0000024ACC3F8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1440-42-0x000001F7B8420000-0x000001F7B8A18000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5816-46-0x0000019B67960000-0x0000019B67F58000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/4912-0-0x0000024ACBE00000-0x0000024ACC3F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1440-42-0x000001F7B8420000-0x000001F7B8A18000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5816-46-0x0000019B67960000-0x0000019B67F58000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5104	powershell.exe
3948	powershell.exe
4596	powershell.exe
1280	powershell.exe
4520	powershell.exe
3500	powershell.exe
4916	powershell.exe
4068	powershell.exe
2268	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1440	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
4712	abe_host.exe

Loads dropped DLL 20 IoCs

pid	Process
2820	chrome.exe
2816	chrome.exe
4628	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
4580	chrome.exe
748	chrome.exe
4580	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 11 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 2 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
5992	powershell.exe
5544	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6004	cmd.exe
6076	cmd.exe
3880	cmd.exe
1892	cmd.exe
692	cmd.exe
4908	cmd.exe
5308	cmd.exe
5592	cmd.exe
4548	cmd.exe
6024	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTransferHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTransferHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BackgroundTransferHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BackgroundTransferHost.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4288	chrome.exe
1152	chrome.exe
2380	chrome.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5264	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4712	abe_host.exe
4712	abe_host.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
4712	abe_host.exe
4712	abe_host.exe
4712	abe_host.exe
4712	abe_host.exe
4712	abe_host.exe
4712	abe_host.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5816	BackgroundTransferHost.exe
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
5544	powershell.exe
5544	powershell.exe
5544	powershell.exe
4916	powershell.exe
4916	powershell.exe
4916	powershell.exe
1280	powershell.exe
1280	powershell.exe
1280	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5264	taskkill.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeIncreaseQuotaPrivilege	2268	powershell.exe
Token: SeSecurityPrivilege	2268	powershell.exe
Token: SeTakeOwnershipPrivilege	2268	powershell.exe
Token: SeLoadDriverPrivilege	2268	powershell.exe
Token: SeSystemProfilePrivilege	2268	powershell.exe
Token: SeSystemtimePrivilege	2268	powershell.exe
Token: SeProfSingleProcessPrivilege	2268	powershell.exe
Token: SeIncBasePriorityPrivilege	2268	powershell.exe
Token: SeCreatePagefilePrivilege	2268	powershell.exe
Token: SeBackupPrivilege	2268	powershell.exe
Token: SeRestorePrivilege	2268	powershell.exe
Token: SeShutdownPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeSystemEnvironmentPrivilege	2268	powershell.exe
Token: SeRemoteShutdownPrivilege	2268	powershell.exe
Token: SeUndockPrivilege	2268	powershell.exe
Token: SeManageVolumePrivilege	2268	powershell.exe
Token: 33	2268	powershell.exe
Token: 34	2268	powershell.exe
Token: 35	2268	powershell.exe
Token: 36	2268	powershell.exe
Token: SeIncreaseQuotaPrivilege	2268	powershell.exe
Token: SeSecurityPrivilege	2268	powershell.exe
Token: SeTakeOwnershipPrivilege	2268	powershell.exe
Token: SeLoadDriverPrivilege	2268	powershell.exe
Token: SeSystemProfilePrivilege	2268	powershell.exe
Token: SeSystemtimePrivilege	2268	powershell.exe
Token: SeProfSingleProcessPrivilege	2268	powershell.exe
Token: SeIncBasePriorityPrivilege	2268	powershell.exe
Token: SeCreatePagefilePrivilege	2268	powershell.exe
Token: SeBackupPrivilege	2268	powershell.exe
Token: SeRestorePrivilege	2268	powershell.exe
Token: SeShutdownPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeSystemEnvironmentPrivilege	2268	powershell.exe
Token: SeRemoteShutdownPrivilege	2268	powershell.exe
Token: SeUndockPrivilege	2268	powershell.exe
Token: SeManageVolumePrivilege	2268	powershell.exe
Token: 33	2268	powershell.exe
Token: 34	2268	powershell.exe
Token: 35	2268	powershell.exe
Token: 36	2268	powershell.exe
Token: SeIncreaseQuotaPrivilege	2268	powershell.exe
Token: SeSecurityPrivilege	2268	powershell.exe
Token: SeTakeOwnershipPrivilege	2268	powershell.exe
Token: SeLoadDriverPrivilege	2268	powershell.exe
Token: SeSystemProfilePrivilege	2268	powershell.exe
Token: SeSystemtimePrivilege	2268	powershell.exe
Token: SeProfSingleProcessPrivilege	2268	powershell.exe
Token: SeIncBasePriorityPrivilege	2268	powershell.exe
Token: SeCreatePagefilePrivilege	2268	powershell.exe
Token: SeBackupPrivilege	2268	powershell.exe
Token: SeRestorePrivilege	2268	powershell.exe
Token: SeShutdownPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeSystemEnvironmentPrivilege	2268	powershell.exe
Token: SeRemoteShutdownPrivilege	2268	powershell.exe
Token: SeUndockPrivilege	2268	powershell.exe
Token: SeManageVolumePrivilege	2268	powershell.exe
Token: 33	2268	powershell.exe
Token: 34	2268	powershell.exe
Token: 35	2268	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 6076	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	89
PID 4912 wrote to memory of 5628	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	91
PID 4912 wrote to memory of 4292	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	93
PID 4912 wrote to memory of 2660	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	95
PID 4912 wrote to memory of 4960	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	97
PID 4912 wrote to memory of 5580	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	99
PID 4912 wrote to memory of 5264	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	101
PID 4912 wrote to memory of 2268	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	104
PID 4912 wrote to memory of 5952	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	106
PID 4912 wrote to memory of 1440	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	109
PID 4912 wrote to memory of 2820	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	112
PID 2820 wrote to memory of 748	2820	chrome.exe	113
PID 2820 wrote to memory of 4288	2820	chrome.exe	115
PID 2820 wrote to memory of 2640	2820	chrome.exe	116
PID 2820 wrote to memory of 2640	2820	chrome.exe	116
PID 2820 wrote to memory of 2908	2820	chrome.exe	118
PID 2820 wrote to memory of 2908	2820	chrome.exe	118
PID 4912 wrote to memory of 4712	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	119
PID 4712 wrote to memory of 2816	4712	abe_host.exe	120
PID 2816 wrote to memory of 4580	2816	chrome.exe	121
PID 2816 wrote to memory of 1152	2816	chrome.exe	124
PID 2816 wrote to memory of 2440	2816	chrome.exe	125
PID 2816 wrote to memory of 2440	2816	chrome.exe	125
PID 5816 wrote to memory of 4628	5816	BackgroundTransferHost.exe	126
PID 2816 wrote to memory of 1476	2816	chrome.exe	127
PID 2816 wrote to memory of 1476	2816	chrome.exe	127
PID 4628 wrote to memory of 4928	4628	chrome.exe	128
PID 4628 wrote to memory of 6028	4628	chrome.exe	130
PID 4628 wrote to memory of 2380	4628	chrome.exe	131
PID 4628 wrote to memory of 6028	4628	chrome.exe	130
PID 4628 wrote to memory of 2400	4628	chrome.exe	132
PID 4628 wrote to memory of 2400	4628	chrome.exe	132
PID 5816 wrote to memory of 6004	5816	BackgroundTransferHost.exe	139
PID 6004 wrote to memory of 3524	6004	cmd.exe	141
PID 5816 wrote to memory of 6076	5816	BackgroundTransferHost.exe	142
PID 6076 wrote to memory of 1548	6076	cmd.exe	144
PID 5816 wrote to memory of 5104	5816	BackgroundTransferHost.exe	145
PID 5816 wrote to memory of 3880	5816	BackgroundTransferHost.exe	147
PID 3880 wrote to memory of 5608	3880	cmd.exe	149
PID 5816 wrote to memory of 1892	5816	BackgroundTransferHost.exe	150
PID 1892 wrote to memory of 3832	1892	cmd.exe	152
PID 5816 wrote to memory of 692	5816	BackgroundTransferHost.exe	153
PID 692 wrote to memory of 884	692	cmd.exe	155
PID 5816 wrote to memory of 3948	5816	BackgroundTransferHost.exe	156
PID 5816 wrote to memory of 4596	5816	BackgroundTransferHost.exe	158
PID 5816 wrote to memory of 5544	5816	BackgroundTransferHost.exe	160
PID 5816 wrote to memory of 4916	5816	BackgroundTransferHost.exe	162
PID 4912 wrote to memory of 4548	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	164
PID 4548 wrote to memory of 4112	4548	cmd.exe	166
PID 4912 wrote to memory of 4908	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	167
PID 4908 wrote to memory of 2056	4908	cmd.exe	169
PID 4912 wrote to memory of 1280	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	170
PID 4912 wrote to memory of 5308	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	172
PID 5308 wrote to memory of 2660	5308	cmd.exe	174
PID 4912 wrote to memory of 5592	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	175
PID 5592 wrote to memory of 256	5592	cmd.exe	177
PID 4912 wrote to memory of 6024	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	178
PID 6024 wrote to memory of 5288	6024	cmd.exe	180
PID 4912 wrote to memory of 4520	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	181
PID 4912 wrote to memory of 3500	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	183
PID 4912 wrote to memory of 5992	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	185
PID 4912 wrote to memory of 4068	4912	2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_2155786abe10bf9a5c5f3c4cd0f1d2a7_icedid_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "MicrosoftWindowsDeliveryOptimization_bk102" /F
  2⤵
  PID:6076
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "MicrosoftWindowsDeliveryOptimization_bk102_UacOnce" /F
  2⤵
  PID:5628
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "ContEXE-Relog" /F
  2⤵
  PID:4292
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /TN "ContEXE-Relog" /F
  2⤵
  PID:2660
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /End /TN "ContEXE-Relog-bk102" /F
  2⤵
  PID:4960
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /TN "ContEXE-Relog-bk102" /F
  2⤵
  PID:5580
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM BackgroundTransferHost.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& 'C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\_install_relog_task.ps1'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /TN "MicrosoftWindowsDeliveryOptimization_bk102_UacOnce" /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe\" --relog-uac-bootstrap" /SC ONLOGON /RL LIMITED
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5952
- C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe" --relog-poll
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --no-first-run about:blank
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x208,0x20c,0x210,0x1dc,0x218,0x7ffac110c728,0x7ffac110c734,0x7ffac110c740
    3⤵
    - Loads dropped DLL
    PID:748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1412,i,17572005086120425381,1064978995350104979,524288 --field-trial-handle=2028,i,10995276649480091834,10846445926443401053,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,2927367662153028247,13596349921217546383,262144 --field-trial-handle=2028,i,10995276649480091834,10846445926443401053,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,4018356210961853464,7228230904177113161,524288 --field-trial-handle=2028,i,10995276649480091834,10846445926443401053,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:13
    3⤵
    PID:2908
- C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe
  "C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe" --unwrap
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --no-first-run about:blank
    3⤵
    - Loads dropped DLL
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1f0,0x1f4,0x1f8,0x1cc,0x1fc,0x7ffac110c728,0x7ffac110c734,0x7ffac110c740
      4⤵
      Loads dropped DLL
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1868,i,14852041383859053974,12800385983397633656,524288 --field-trial-handle=2836,i,7629604054973876430,5201746858639589615,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:11
      4⤵
      System Time Discovery
      PID:1152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,14255195840933624877,15887408242122758754,524288 --field-trial-handle=2836,i,7629604054973876430,5201746858639589615,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
      4⤵
      PID:2440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1724,i,6043201881368105940,12869799203173425082,262144 --field-trial-handle=2836,i,7629604054973876430,5201746858639589615,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:2
      4⤵
      PID:1476
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
    3⤵
    PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
    3⤵
    PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; [System.TimeZoneInfo]::Local.DisplayName
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    PID:2660
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
    3⤵
    PID:5288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; Get-Date -Format 'M/d/yyyy h:mm:ss tt'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $list = Get-WinUserLanguageList; ($list | ForEach-Object { $_.LocalizedName }) -join "`n"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $lines = @(); $c = Get-CimInstance Win32_Processor | Select-Object -First 1; if ($c) { $lines += "Name: $($c.Name), $($c.NumberOfCores) Cores" }; Get-CimInstance Win32_VideoController | ForEach-Object { $lines += "Name: $($_.Name), $($_.AdapterRAM) bytes" }; $b = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory; if ($b) { $mb = [math]::Round($b/1MB, 2); $lines += "Name: Total of RAM, $mb MB or $b bytes" }; $lines -join "`n"
  2⤵
  - Enumerates connected drives
  - Uses WMI to collect hardware manufacturer information
  PID:5992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | ForEach-Object { $_.displayName } } catch { }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  PID:4068

C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-gpu --no-first-run about:blank
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1f4,0x1f8,0x1fc,0x1d0,0x200,0x7ffac110c728,0x7ffac110c734,0x7ffac110c740
    3⤵
    PID:4928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1628,i,1372012423025223315,1456029541981280298,262144 --field-trial-handle=1972,i,5020654611174114406,13593946169774745747,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:6028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,3455296616930566744,9683375634140334271,524288 --field-trial-handle=1972,i,5020654611174114406,13593946169774745747,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,3278648323832846787,11266126072279997528,524288 --field-trial-handle=1972,i,5020654611174114406,13593946169774745747,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:13
    3⤵
    PID:2400
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"
    3⤵
    PID:3524
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductId"
    3⤵
    PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; [System.TimeZoneInfo]::Local.DisplayName
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    PID:5608
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    PID:3832
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
    3⤵
    PID:884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; Get-Date -Format 'M/d/yyyy h:mm:ss tt'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $list = Get-WinUserLanguageList; ($list | ForEach-Object { $_.LocalizedName }) -join "`n"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; $lines = @(); $c = Get-CimInstance Win32_Processor | Select-Object -First 1; if ($c) { $lines += "Name: $($c.Name), $($c.NumberOfCores) Cores" }; Get-CimInstance Win32_VideoController | ForEach-Object { $lines += "Name: $($_.Name), $($_.AdapterRAM) bytes" }; $b = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory; if ($b) { $mb = [math]::Round($b/1MB, 2); $lines += "Name: Total of RAM, $mb MB or $b bytes" }; $lines -join "`n"
  2⤵
  - Enumerates connected drives
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $ErrorActionPreference='SilentlyContinue'; try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | ForEach-Object { $_.displayName } } catch { }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abe_host.exe

Path C:\Users\Admin\AppData\Local\ContEXE\abe_host.exe
Size 110KB
SHA256 dcbd1ad12cd04c6f62b25ff60554687613ab06c449a38b0700477621bb91a5ca
MD5 40ad7d301c8da4dff37e8e1e50b7b1bd
SHA1 95895d214b53753a482970c4e71ce439581b1fd1
SHA512 802695b0f093b433309e4a82fd93a7c7d9a709ee128a40912f48e778413939ec4b5e733286f950793fb423aa47f6c70b6279838a7ee6c6c83d964e955f14dc90
SSDEEP 1536:9WZSSY3wj16x5ZlSCcHSOzGAkOMUmXRtS780HCO70WRdoiPXDDhIK8WISEeyk+wz:9kY3wj16tlSTy9ROMUqtStiPWboij
TLSH
T1C9B35B0BB65355ECC116C57886E79A72BEB2F82904306E3E1394DE321E11FA16F3DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc09ea3f1b17d44c006ad107.token

Path C:\Users\Admin\AppData\Local\ContEXE\cc09ea3f1b17d44c006ad107.token
Size 46B
SHA256 255b874cb3d24527dc36dadf64c542425900191b2e52289a0b76e21bd7a1c48b
MD5 e837c9010db2a22ab09e62256112161f
SHA1 4c39db09496e137e6bbbfb8a21a02114064280a6
SHA512 fd187ac497aa960bbf2b1a976cef68fb7d22fc200298698eb46a331422835ed4dee986dd6b392754951d03fa63dec17f545597e80a66d384b6ac5be019f672ce
MD5 SHA1 SHA512

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 28747dd823a22ddde7254435f60a1f2079c60c544973d35457bdd0a197847862
MD5 b9ed70b18eff304866cdb4a908f13eb6
SHA1 d40ea82b076a97ae2edc3cba6e334b2d0667d4fc
SHA512 d9167539bb012902d9aa7745cbd5aec3e9f958a5469c43720b63f0afeaa8fa40173da85d8af2cbf567ad56319af6c735ce16b658a8aaea016296fcfa53815e70
TLSH
T1FA314576908C60B91A905E93ECE7FB30DFEBD40CDF356117708568CD448554A22DA66F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 e86013c1f97da672e8d12b3ec89f12bf02ffe628a0529df1bea01d734d54baeb
MD5 69ff39b8c119c6f38797afa93856dc37
SHA1 e23fbc2a5ff81187795d5d9360c2105832e88df3
SHA512 f9802f6820ac1984b295fae1e668a2699f473bd5230df8f3515023474a50480810293aad315b9a23f867df8d8f16cc14afe5c6c58933443b48d4b56b1ae710eb
TLSH
T178317676908CA0B927905E53ECE7FB30DFEBD408DE3561177585A8DD048590E22CA66B
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 2KB
SHA256 be0e461e7e5adcc4d41d98fee5622173a0d259ddf5db75ce3d913da9b0808043
MD5 e174b91f09b9b2c7cbdf922dc488f7d2
SHA1 50db6bad0ba83687b6219d1751074c730684c6d5
SHA512 cc6f687b068a324bd05ab79b1310f7d75678e01481147fc3d6b160e8d31c155dcb6d7d6de413e1149691d8b4c4b6ac929e38bc4f330a3472d5e1488821538267
TLSH
T1614172A2C088E0A917805A93E8E6FF30DFFFD40CDE286127748558ED408955E63D975F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 2KB
SHA256 b037cb52df3a098ad0096baaff9342954d1f47a99ba5f232a8f8260fd7de45c5
MD5 cb0b2ade437695243fb7379b182a7e51
SHA1 cfcd4e04878e058bd7c5edbb2afa3adfdd313d6c
SHA512 e303f4028e89ce20d2683bf46b8a85c53ae3e048d705938d071ec03d43c0d2890e91380c278911f4fa13dec3ee94deae1668805cd97b2f5cd626693966742015
TLSH
T1035172A2D448E1AD17C08A93E8D6FE30DBEBD00CDA292127348594ED408855E63CE79F
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 4KB
SHA256 8488cb9c36fb7aa46bf1e981b9821b1175839f4e77a1710dba5cad08f782b3b6
MD5 23dc147ef66b093be767ffdbf06bb4d9
SHA1 a9cad80b69b0865d5e36a4439aa18b4fe299f9bd
SHA512 84f4c54392789050f5094b5eaa70fd33540f49951e3eecbd62a641d4c693f81b1893e722033aeeaa79fa6876b8f882308e3910bc199896913b5948d39560b0e2
SSDEEP 96:/1Krozmf5yumBJ7w1/C+GDgwS/g8Yw1/ps/C/u/W/OF:/gkcQ7w1M0pBYw1oF
TLSH
T1A7914F47C884D8A903C094D2E852FE18DFFEB018E6A921373952D8EC498955DF3CCB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 f393be09941e5f44efee8be0a76937efa5ad046cd97fbad37e1d2fc53891a683
MD5 a8b2335c3ea2a5a9babfbff39442e41c
SHA1 96474270f218986c23659f99640c7d1beb7e006a
SHA512 c3ae146bc5a1e79b974bfa0195b34b8a743c155b4c9d13ec15cfeb573013a0f64baceab5398299793d8495b4dfa96b73a9971a4152c07554f29bc4548e7d8522
TLSH
T1C611F076D0DC24761D512EA7ECEBE330DFFBD84CDF61A20260466CC9448694A21D625B
MD5 SHA1 SHA512 TLSH

Submit Download

last-run.log

Path C:\Users\Admin\AppData\Local\ContEXE\last-run.log
Size 1KB
SHA256 0c35be53b6e6f64d0d6ef8f2a07c51a653c015b3e68ef69103e1075e9a2b662f
MD5 2c0e91c2ec5fbb48704eba275fc60f7e
SHA1 d3aa9af4c828d66eb76fd622543eca5e7af38383
SHA512 e6319de69437df346b4c38a22583903ac08e7372c24b249e81635af61e422ebd9e1933f958f0177bce9135ffe22ee1f10674edac309d6a4a0859d9def5297dc0
TLSH
T1872100B6D09C64B629502EA7ECFBE320DFFBD84CDF71A103604668CC448644A12D621B
MD5 SHA1 SHA512 TLSH

Submit Download

1740b097-04a9-4296-bc24-392045cf5c73.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1740b097-04a9-4296-bc24-392045cf5c73.tmp
Size 4KB
SHA256 6015842f32734d02e1c3bea8975d80f3961ac0fade813e8e6e59128da2e23f7f
MD5 4ac11907d2e85e7f00a46c548efeb3f2
SHA1 e05e7b64a985a486b570ffcc0bc970c2689f931b
SHA512 8e6073046b96202c8d189dae9ed8388fa776d12b86db2bc670e18d77bc421d5c8b41a4b3261ea6c2f16a080628ec46c3209332df2dc1108a706ba47e8868bcb3
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5hp0cDJB6vGyvtBWG0c03bOv4a:CC0oWqNVVxi+9oP8DUDb0KPDeW9c03bQ
TLSH
T191A12A31A87999B789F6D485B1463E538FB870AFA521DFD4E8EE1D1C20B30AC1342637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32e63c05-fc65-4420-9a55-b7402d50ab64.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\32e63c05-fc65-4420-9a55-b7402d50ab64.tmp
Size 5KB
SHA256 2df6fbf14af1a0c168df559fb3f93a1050e7c8dfc268eb448147c22030c2870f
MD5 1a1df7d773d65d7a1def849d594a0f29
SHA1 84f7c769b60ef84d7d05850a65130ee11b3fc655
SHA512 7174ba31e7bfe74ab99d68bfb2150f64dad71617fc904ea0a07a910094846b5493a456c7db91964dc9a4270a1317f12b9dd3edf1f809e29e62fd08609d3ef7e7
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUPKdySl8h4otok5hpZDJB6AGyvteer5AujWtU:CC0oWqNVVxi+9oPXiUDbJPctMjWtxrab
TLSH
T1E2C11971B86D697789E3D896F0023D938FB471AB56159FA8EDEA0F1C11F319C1382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 685b74ac6b47cc67ae7434a98329f9111a7b5c168707e70b55be1a68d729ec12
MD5 0a5be5c7ba33a6c408691d82d7affa3e
SHA1 dd80476f918154cb44942aa2c9ec051f46116136
SHA512 a8a03053cc90b92445b36b42d8981d02fe131d68edfa6911d6a648f7e0a1f636527df56b572083d39d96fc22e9ad9ddce1f824c8f584aa04165b938020cd20fb
MD5 SHA1 SHA512

Submit Download

5834026e-9ae3-41ed-b700-1a0d94f08daa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5834026e-9ae3-41ed-b700-1a0d94f08daa.tmp
Size 10KB
SHA256 e496f9a83800eca514c6069bfea1eb81e2729ed3f5f3d788f6cf702363273688
MD5 ac981c3940c5b83883bf25f4d3d34984
SHA1 0e530726d6bf38a071c3778f37db94d044d34149
SHA512 6a77176db6182866518eec643e9c1ebcfd04bcd42d398e39aef23292a2417088035ade6be36ac0013852162fd899ca91d30b24cd9444a7dd26f0433b6126df8d
SSDEEP 192:gR48P9v7cvAPRp2GXsb+WNnS42DLjGyIsnAUgR:gR48P9A6XlXwB2DmR
TLSH
T1D222521DAD14B53F9DDAD21AFA3276A7D3F5103234902E84E6F9893C21D79CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e49f735-65d0-45d6-a233-6aec4eed255d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5e49f735-65d0-45d6-a233-6aec4eed255d.tmp
Size 9KB
SHA256 5dc5a9235df895c4797203b349b2901edf594e24bc5ad1433e4744711c76f30e
MD5 3f1d37439de9874faaed88ed2aaaef15
SHA1 d5fc2262e916486535638ea6331d25981848d546
SHA512 b244bc137d8ed50f26088eb32e5bc695efe81f54ba1ec68be74fe8e79833f123f6e6c0513861e326ed81df8cb88707eb5e4b4b3bdce08678f30e395cd5a19fef
SSDEEP 192:gR68P9v7cvAPRp2GXsb+WNnS42DL5GyIsnAUgR:gR68P9A6XlXwB2DUR
TLSH
T16322611DAD14B53F9CDAD22AFA327667E3F5103224902E84E6F9893D25E79CC6227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 9c759df29e70f21915eda7edddc6617535a9f7320d9c786fe5d9b1648a13bc47
MD5 295fd6f4098e64f3cc8875e0f0aae875
SHA1 388aeb0722ce21953117b637c3e408cabdb2049c
SHA512 45e056cefa5803bd240abb962a0cc47ce283882d46138b557ff84f0239a97e169cc3a47dcc7d566425c0252abd121e101dd0024e4db011baa734171f967c71f0
TLSH
T1C9E086E464A9C6AE60588463437E735C8FE0B907F6C838575B45D45036C690865E2364
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 b58eb451abc958cfb08c6083a6c680376d801038a9841836a3bbdc1b38c4b80a
MD5 652bb9c80f987082fc75f2e5393308f5
SHA1 f95263e89ffeefffb648d9dc3ea911634e922bec
SHA512 8ba05c05339cde26bb6a800001eb32abd1101a08935ba7cae6130171718b31f706b44ba6231a27fda683f6a239f2510cff39730fffa3da9fa2f4361eb7ae9fd3
TLSH
T14EE07DE424CCC52FE05CC427837E730C8FD03402F3C439460745E440368E515A1C03E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 70ba5622928676cc7e92aaa188c38848e37f361eebf7f9a34ac91869eb97da51
MD5 b426be70cf2edebd2a591f40b85b833f
SHA1 5a143210b473aa785f92b099261d984752c3ae0b
SHA512 9cab73bf2ab92bfbd9a0ca9dbf0a3d720ac5c7bf3b4406417ad3e33abb61ea7bb5ec5276c3cec9b71c40d3e43565b0c465089d6725f9b264e3ac237c43132629
TLSH
T1CBE020F0258DC51F314D801B933E730CCFF03906D6CD2A550F04D55079C940862C03D6
MD5 SHA1 SHA512 TLSH

Submit Download

aec8bd3f-01c0-4008-9230-627a60062c25.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aec8bd3f-01c0-4008-9230-627a60062c25.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

f8fb90b3-d587-4a88-9e48-112f096096ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f8fb90b3-d587-4a88-9e48-112f096096ec.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e3eef6e08f0b3004e6d575959a2f63293d368999e13f913185ca25e8fe7ad623
MD5 990864fc7d3ac23f3f319f9da84a8583
SHA1 4b7fe83d45ce8973d1bdca9fea5207d92c3f2291
SHA512 c5518a7b0f89b3212b40c376da0fc79e8c9195c34b13c84a82063d3efab78745885f5e0179ac8ce7b8ab955a3259884fcb0e0cd4aad01c221363347220014192
SSDEEP 192:gR68P9v7cvAPRp2GXsb+WNnS42DLoGyIsnAUgR:gR68P9A6XlXwB2D5R
TLSH
T1C222611DAD14B53F9CDAD22AFA3276A7E3F5103234902E84E6F9893D25E79CC6213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 64223e8b669ce1169b615c31856bdcc28c44020901c476b623acddb783b81b99
MD5 c103caecde28dcfb36d0b9f9ea764abb
SHA1 62b51a4c144dcafcb32c53d1f4b0cac28660a3fe
SHA512 f3ed9b0d5211979966571d3d0ab0098fcc3d67d170bed6b1b5c26576ca4cf11c54ac411a91679d5b3a4aec676e34fd89c5945051ba61b92711378879c1a2c0e2
TLSH
T160E086F065D9C57E6069802303B6B30CCBE4F917E7CC38565F82D6902ACBD0C76A23A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 1bf0cb4e9129242f0e8eac7d8ff33ea4cc6bce138e7dc209f8f57d47d4494282
MD5 c3c35927f13cc1ffd40ba7f02fe50378
SHA1 6d3ab624edec5489bb9c3d90f0a2c38fbcb3bb46
SHA512 719399917f8b6ebee05c5a1edbdad76827af673b30b075edc009c4f9b01644b425db9d48333629499496e2acf7c864efe14f5347c0c32616b18b99314d123654
TLSH
T138E026F029C8C53E605980030335A38CDBE4F417E2C93D461F80EE402BCE8087491761
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 8eab96347c868e3fd77e8ef539ed8206b94f3fe3799777f980b671326f4700fa
MD5 d59cf0014dc041ea9c82753d8905d531
SHA1 cfd6fcabf35e84b7b8b6556c5577dc5aaa07f40e
SHA512 815bfb8f4398ff95ab73de55ee6b23fee8700b94a7a44633babe9db29292231a3bf99db0cfc95567bad2a0c64d723d0f13eca6c9358f24356660bf1a4e52127c
TLSH
T198E0DFB026C9CA2F2099806B5326F30CCBE1B803E6DD1466AF06E280678E80472823A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 0937d0ed0a181adf45b05132935b0626453aed332862064c407909a9ff8aa9b7
MD5 527881a9d85a04ea8b6ab2383fa86324
SHA1 7a7ee90e581026de96e5d8e0e85e98ec7f240c75
SHA512 586c949174e0dce384038126e6c719896d06c1ae0c7518b7e73a9d97f8b0535f7d511df891c44e7efcfdc6eb5edb3e01893124aeedd1e54e22118f6285d16699
TLSH
T165E04FB036C9CA2F208A905B2779F34CAAE1B806EAD914562B16F6A0778E504B192765
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 9ccc76bb9339262a75084d86824603770202bbd1b8b9418f2c75cf47c90d5694
MD5 b7774e378d055397090ddbccadec673b
SHA1 f4c39b0a512e38937bdb0a92e15ab68747a1b3fa
SHA512 64968fdcc7935bfcc6abba7030be4f085b3f80e3e9dea39aa96dbbf32a8fa11bec27ca6c6e11358a95cf023c1f49843f97c7cc87e4ed2dc457c6545da8e30fa4
TLSH
T13BE086F465C9CA3E2058C053037AB70DCBF0FD07E7C9359A970498907A8691865B07E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 6d490f9f2b1cfc17a98d33a8f1e9bcc24f7a725858b12722b9131f99c69ba097
MD5 cdf05868d8c83e962ff58b45d3534434
SHA1 cddc780bdbc705a87df8620696d54bc9190a97d3
SHA512 a0203f2fc11b5599401b5e6590a621ac503c262885cf283774d7c68265dc6c3ad238f8fe21d9ad06632462ae02e8a5eda1ba0034ae02e6a3a07976b4c3765b36
TLSH
T16EE08CF025C9CA3E208DC05713B9B70D8BF0BC06FBC9398E5B08F4507A8A508A6A07A5
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 e7bc0e1fb3e64ef7c009749756152716e7153f7cbfd26fe846282f9d5357d9b1
MD5 a4a9840e6d1d8259f7252a910a4db66e
SHA1 addcf638408523e92903e344cafd79c11b505226
SHA512 b9d8b6465f3bfee7d4808affef1a82fdc0b2ebd161c92a5bc6d7c5d01d0538945e65d554cff83c129c29b782207db17741b10334a65cf68eb459641f6877e673
SSDEEP 48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBDLUL6VL1L4:v7doKsKuKZKlZNmu46yjUY
TLSH
T1AA032E8E8BB851F3C0F2C13EEEC246E2FC7C2A0CC7262DD115E903B55E88036517566A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7087d67-ec67-4b3e-83bf-fe67cd6ea225.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a7087d67-ec67-4b3e-83bf-fe67cd6ea225.tmp
Size 11KB
SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
MD5 732de8cdfa44549aee916b3128c61ae3
SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
TLSH
T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 11ac6656ca65752500bb41e9635c52df8604498a637ddf6d2382c84fd6a08707
MD5 075dc433404c824adfa2de6c84430a29
SHA1 3c3d2d3e2db9d677f5f1664fbebe56b0a85fb64e
SHA512 52678dbcbd8eac7f321c04c79434145907c0c95819168bc17fff135bc169ed46153d2e287e62e4d654b000720853441f56d7307452966815f75f911ca11fdc26
TLSH
T133E086F0F9C9D56FB1A8806712B7674CCBD07D07FAD814AA5F02D494668B91461913B4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 808B
SHA256 96a1880fb527c18f8ee8b9c0188d4dd9429a11e986b3006323efb76925ce43c1
MD5 456f694b43666cc0cdda3487d1328bda
SHA1 c7fd6ad7c8ed5d5c7e9d3646a56076467223cdec
SHA512 3cc1aebbd740f17db606c74060ec20502145991f384f477d7705239dafc9c56a73cff69ce80cc8c98685a58ea51cc9f84f73e965feb3329a34f41e4824739335
TLSH
T1C6011D16F331C414D19A927A643AAB251374D8669FF8EE0F587564282E33E141D4B7E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 bd605e88210c3c44e6210117d56582e4d8bc26f264282f4a40d95a5939177553
MD5 70e416735e959418c8e934e36146357c
SHA1 0cafe71bed7240faafb94a397d1780fa8094804b
SHA512 8e09c2bf7d76724b76d82f3c6a162c5bc767a5a46f8889a666645a6f07590631e2172a398b73c750b9ad6c7fb2124339dc5a38d27224dbe0e9aed223cfbb57f3
TLSH
T11EE080F0F485C99F906540630276A34CCBE47D07FBD91D555F41C9547A855047592394
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 da613811356c57bf77061b7a643a3f31cae7585c931dd60c24b9164bf465ac5c
MD5 c602568889329e9a52fc97bd27649440
SHA1 941bfe6989fcca3347037959bc64a069d69d245b
SHA512 986d648afad0b8e992df5cfe89b01a39bf1f3f3b3deabdbb8bf85136e2d4e15e189f0ad643b9d3810e1cab8fe7fad9d83fe2820a77be070a278d0589cdf27a1e
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUPKdySl8h4otok5hp6DJB6AGyvteer5AujWtU:CC0oWqNVVxi+9oPXiUDb8PctMjWtI6P8
TLSH
T1D3C11A71B46D697789E3D896F0023D938FB461AB6611DFA8EDEA0F1C11F359C1382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

a849db99-f064-475c-a19b-f6a8100469f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a849db99-f064-475c-a19b-f6a8100469f1.tmp
Size 5KB
SHA256 4251b1d57fee5e88167477cc96632d58a785cb10e08821476af1660d094fbe03
MD5 f1fd0b29cdf5109436a1c7d1ac20d76d
SHA1 3bed74ccf72af93ce0d01ff514fa933a997d7198
SHA512 309405a9d50bf2ea999fbcf8057e336224248f3a62bb674eff76e0bac5254a240a259e54e2ba1c647799a19ae6b7c271ad7bfcef2160bd23aa66bc254af955fe
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUPKdySl8h4otok5hpcDJB6AGyvteer5AujWty:CC0oWqNVVxi+9oPXiUDbKPctMjWtLdvI
TLSH
T180C12B71B86D697789F3D896F0023D938FB461AB55159FA8DDEA0F1C11F319C1382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackgroundTransferHost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\BackgroundTransferHost.exe
Size 1.6MB
SHA256 263272acfcbea8dbff33b10482e86b831f5508ccd533d8230b0a82722fb8ec11
MD5 2155786abe10bf9a5c5f3c4cd0f1d2a7
SHA1 fa2dd0802acd3c04259e72408b79ba1787526a46
SHA512 b2fc5365756eb0ff83414a6d234f8ae77195b775455a6b1614a13033d6f31c7e170069c5814bd4a6de9dc5e446d23299d2d5a65f321f6f9aea73b8ffdf5296b1
SSDEEP 49152:CX+KdcKnNBXFc1UEJvIZfliWwAucLsai0boe:CX+KdnNByUwIgAYai0j
TLSH
T127751255B3965CF9E8B7C0389D828506DA727C525BB1EACF0B604AD79F231D08D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_install_relog_task.ps1

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\_install_relog_task.ps1
Size 1KB
SHA256 c4a4074df9711264cb024a6d97db77a4555d680cab78ffb39ac452d17bdac0a9
MD5 5cf34b53646aebd20b3f97d64285826b
SHA1 7b2268b00bf49d42c8f70c30fe6d0ae2421de4d7
SHA512 4f772d4a84606c2c9c22c43e1f9dc481cb2bdc66727e94546522902e3acccb4df9603a3310ed2fe70550d326174155548e28a30b6ee79ab1e6c081ac21074b04
TLSH
T1B421CE35B60870EFD6232E3AC2C7D7E63EBD107940338609C955D019A2D646FDB1782B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zhoacsan.5yp.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zhoacsan.5yp.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

abe_1330_240766562.dll

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\abe_1330_240766562.dll
Size 44KB
SHA256 c190fbb3791c55ade7d4d74fb470d687ba92bf611107df8c922119619fd50df5
MD5 33101ff793ce4d726e3337dc5b8de8c8
SHA1 f650da4260d7fa85d847bc88678122d643e43745
SHA512 3df545cd2b5a9de1c7c55e59e5d76a64a71edc0e05bff326b48849264739f98ead12e3b41e67781fca4ee72ef9b766c3d592fcd259be0fb3c1d996df19b74ee1
SSDEEP 768:Lc+JVxAwA6vutUvv1LtS78kHHCezlMU8+guydMOXGRdcoQj0FnFhL:imXRtS780HCO70WRdoiP
TLSH
T173136C0F76A3A5FDC506C53892E78670B871F83914306D3F2399EB771E26E112B2E619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cipher.bin

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\cipher.bin
Size 640B
SHA256 b00ea4cab23f24626b2292d0a3760b28a8d56baae83832d1f633926124487f88
MD5 a53b5191befdef20d273d96a8a741596
SHA1 09c368e9088b85a234fbb32e4652cbea676ba104
SHA512 211d2bf8357a4dcff1ee8d44517935d048204fe7fa2c0ea9458b4e6b07a4eb225a10efde854fac527d4df1e0e77b04f67ce4b052e24b08baa9cd90601f8e6eb2
TLSH
T19DF02DE1DBFE408DECD240B01C762A20C3D98D71FA9AA6AC60E03028546A642C716A13
MD5 SHA1 SHA512 TLSH

Submit Download

config.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\config.txt
Size 80B
SHA256 b28401d5e62e7951e1a3617094edbc1d01ecc4fe9fe912281ccb365bc40e7c12
MD5 41efc48b9aadf5f3e1bb8cb43e830f3a
SHA1 dce9d28bd913a1758911c3e62f6969c81642443b
SHA512 757bdd3f922e2c1d15290a4dcc11178077119382f01431942b1adaa519e4011d7c0a05105712472f1e3ccd71cc6cf975b967bb4cb2fb20dc67e2eabff89e07e2
TLSH
T1F7A01188BA38038AA00030882CAC0200080802AA28BAA0C20A082AAAEE000022A308A0
MD5 SHA1 SHA512 TLSH

Submit Download

done.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\done.txt
Size 11B
SHA256 393f59d1dcb524d6c1d9f03bc60e9836dfd21b2b856f2892bb61714c8aaee994
MD5 0d17c444cb370142a149b5736aa8eaab
SHA1 5bb9c0be06a5dc758e594c50bf33ca1ef2e6ad27
SHA512 3e62baa486f1ed9c55d724bdd025bc9a5e3d339cd961ae5dc5ad97a4fb3b32cfb78299e790a89de2de6924ae2b77af0fd40a7a7d7372efcb1eadddf64175b7e2
MD5 SHA1 SHA512

Submit Download

done.txt

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\done.txt
Size 21B
SHA256 ec03a5dccc54b25832f5c6928dd62a73d7db4a45c63b8928bf9df672cb955c65
MD5 afd6878f65314e2bece9db10858c784a
SHA1 6956c5377a4386bc89f6e163173acdc79857b6f3
SHA512 6e62623ae743de19366c08e59bc88f4eaac7342425e5a28a2d2e63daeca8969e4e26c13d7d610cd2d493d2d80b783033bce1e463552db52e3295f6a14f75a1d1
MD5 SHA1 SHA512

Submit Download

host_unwrap.bin

Path C:\Users\Admin\AppData\Local\Temp\contexe_abe\host_unwrap.bin
Size 661B
SHA256 05749f34915db117123a8b1cecfd57a5c2539f826bc63ae641ae5451981ea6ef
MD5 ddba5d98ac965b2c247bfb803c0f928a
SHA1 0c2cf1a0b8abf9e998276f4c485a9083c6b37cf7
SHA512 7fc6e932e923040059ddb3dbc5008be4d7b6e3c9e3b352dcd65707eb761ff2da66b8d04416360abc9b7419b3993ce27944cdef7b585d0e15dac48eef537fe0e1
TLSH
T19C0123D1DBFD40CDECD140B01C763620C3D5CD71FA9AA5AD60E03438546A541C715A13
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1440-42-0x000001F7B8420000-0x000001F7B8A18000-memory.dmp

Download

memory/2268-29-0x000001E569420000-0x000001E56943E000-memory.dmp

Download

memory/2268-27-0x000001E569330000-0x000001E5693E2000-memory.dmp

Download

memory/2268-20-0x000001E569280000-0x000001E5692A2000-memory.dmp

Download

memory/2268-26-0x000001E569310000-0x000001E56932E000-memory.dmp

Download

memory/2268-28-0x000001E5693F0000-0x000001E5693FA000-memory.dmp

Download

memory/4712-352-0x00007FF6898A0000-0x00007FF6898C4000-memory.dmp

Download

memory/4912-0-0x0000024ACBE00000-0x0000024ACC3F8000-memory.dmp

Download

memory/4916-471-0x00000183EA210000-0x00000183EA2C2000-memory.dmp

Download

memory/4916-472-0x00000183EA450000-0x00000183EA47A000-memory.dmp

Download

memory/4916-473-0x00000183EA450000-0x00000183EA474000-memory.dmp

Download

memory/5816-46-0x0000019B67960000-0x0000019B67F58000-memory.dmp

Download